1# Soribada - A Korean P2P filesharing program/protocol - http://www.soribada.com
2# Pattern attributes: good slow notsofast
3# Protocol groups: p2p
4# Wiki: http://www.protocolinfo.org/wiki/Soribada
5
6# I am told that there are three versions of this protocol, the first no
7# longer being used.  That would probably explain why incoming searches
8# have two different formats...
9
10# There are three parts to Soribada protocal:
11# 1: Ping/Pong to establish a relationship on the net (UDP with 2 useful bytes)
12# 2: Searching (in two formats) (UDP with two short easy to match starts)
13# 3: Download requests/transfers (TCP with an obvious first packet)
14
15# 1 -- Pings/Pongs:
16# Requester send 2 bytes and a 6 byte response is sent back.
17# \x10 for the first byte and \x14-\x16 for the second.
18# The response is the first byte (\x10) and the second byte incremented
19# by 1 (\x15-\x17).
20# No further communication happens between the hosts except for searches.
21# A regex match: ^\x10[\x14-\x16]\x10[\x15-\x17].?.?.?.?$
22# First Packet ---^^^^^^^^^^^^^^^
23# Second Packet -----------------^^^^^^^^^^^^^^^^^^^^^^^
24
25# 2 -- Search requests:
26# All searches are totally stateless and are only responded to if the user
27# actually has the file.
28# Both format start with a \x01 byte, have 3 "random bytes" and then 3 bytes
29# corasponding to one of two formats.
30# Format 1 is \x51\x3a\+ and format 2 is \x51\x32\x3a
31# A regex match: ^\x01.?.?.?(\x51\x3a\+|\x51\x32\x3a)
32
33# 3 -- Download requests:
34# All downloads start with "GETMP3\x0d\x0aFilename"
35# A regex match: ^GETMP3\x0d\x0aFilename
36
37soribada
38
39# This will match the second packet of two.
40# ^\x10[\x14-\x16]\x10[\x15-\x17].?.?.?.?$
41
42# Again, matching this is the end of the comunication.
43# ^\x01.?.?.?(\x51\x3a\+|\x51\x32\x3a)
44
45# This is the start of the transfer and an easy match
46#^GETMP3\x0d\x0aFilename
47
48# This will match everything including the udp packet portions
49^GETMP3\x0d\x0aFilename|^\x01.?.?.?(\x51\x3a\+|\x51\x32\x3a)|^\x10[\x14-\x16]\x10[\x15-\x17].?.?.?.?$
50
51