1# Soribada - A Korean P2P filesharing program/protocol - http://www.soribada.com 2# Pattern attributes: good slow notsofast 3# Protocol groups: p2p 4# Wiki: http://www.protocolinfo.org/wiki/Soribada 5 6# I am told that there are three versions of this protocol, the first no 7# longer being used. That would probably explain why incoming searches 8# have two different formats... 9 10# There are three parts to Soribada protocal: 11# 1: Ping/Pong to establish a relationship on the net (UDP with 2 useful bytes) 12# 2: Searching (in two formats) (UDP with two short easy to match starts) 13# 3: Download requests/transfers (TCP with an obvious first packet) 14 15# 1 -- Pings/Pongs: 16# Requester send 2 bytes and a 6 byte response is sent back. 17# \x10 for the first byte and \x14-\x16 for the second. 18# The response is the first byte (\x10) and the second byte incremented 19# by 1 (\x15-\x17). 20# No further communication happens between the hosts except for searches. 21# A regex match: ^\x10[\x14-\x16]\x10[\x15-\x17].?.?.?.?$ 22# First Packet ---^^^^^^^^^^^^^^^ 23# Second Packet -----------------^^^^^^^^^^^^^^^^^^^^^^^ 24 25# 2 -- Search requests: 26# All searches are totally stateless and are only responded to if the user 27# actually has the file. 28# Both format start with a \x01 byte, have 3 "random bytes" and then 3 bytes 29# corasponding to one of two formats. 30# Format 1 is \x51\x3a\+ and format 2 is \x51\x32\x3a 31# A regex match: ^\x01.?.?.?(\x51\x3a\+|\x51\x32\x3a) 32 33# 3 -- Download requests: 34# All downloads start with "GETMP3\x0d\x0aFilename" 35# A regex match: ^GETMP3\x0d\x0aFilename 36 37soribada 38 39# This will match the second packet of two. 40# ^\x10[\x14-\x16]\x10[\x15-\x17].?.?.?.?$ 41 42# Again, matching this is the end of the comunication. 43# ^\x01.?.?.?(\x51\x3a\+|\x51\x32\x3a) 44 45# This is the start of the transfer and an easy match 46#^GETMP3\x0d\x0aFilename 47 48# This will match everything including the udp packet portions 49^GETMP3\x0d\x0aFilename|^\x01.?.?.?(\x51\x3a\+|\x51\x32\x3a)|^\x10[\x14-\x16]\x10[\x15-\x17].?.?.?.?$ 50 51