Skip to content
Michał Kapała edited this page Aug 5, 2024 · 13 revisions

SRP (likely Segment Relay Protocol) is a simple reliable protocol used for communication with Ubi services (e.g. GSNAT).

Segments

The packets are called segments and are sent over UDP.

Header

struct stSRPSegmentHeader {
    unsigned short checksum;
    unsigned short signature;
    unsigned short dataSize;
    unsigned short flags;
    short segment;
    unsigned short ack;
};

Checksum

unsigned int __thiscall clSegment::CalculateCheckSum(clSegment *this, __int16 startValue)
{
  int len; // edx
  unsigned int checkBase; // eax
  int halfLen; // edx
  bool bEvenLen; // zf
  int buffPtr; // ecx

  len = this->length;
  *this->buff = startValue;
  checkBase = 0;
  halfLen = len >> 1;
  bEvenLen = this->length % 2 == 0;
  buffPtr = this->buffPtr;
  if ( !bEvenLen )                              // if odd, add the first byte as extra
    checkBase = *buffPtr++;
  if ( halfLen > 0 )
  {
    do
    {
      checkBase += *buffPtr;
      buffPtr += 2;
      --halfLen;
    }
    while ( halfLen );
  }
  return ~(checkBase + (checkBase >> 16) + ((checkBase + (checkBase >> 16)) >> 16));
}

Signature

The value is sent as the 2nd u16 of the SYN response's data and resent in later requests without changes.

Data size

Length of the data to read after header, in bytes.

Flags

6 least significant bits are reserved for packet type, the rest is protocol identifier which should be set to 1 (0x40) for SRP.

Flag Value
FIN 1
SYN 2
ACK 4
URG 8
unknown 16
unknown 32
Protocol ID (SRP) 64

Segment

Incremental segment identifier.

ACK

Segment identifier of the acknowledged segment.

Window

struct stSRPWindow {
    unsigned short tail;
    unsigned short senderSig;
    unsigned short checksumInitValue;
    unsigned short windowBufSize;
};

Tail

The receiving window's size in bytes.

Sender signature

The sender's signature to be used by receiver.

Checksum initial value

The value used as startValue in checksum calculation algorithm for the response.

Window buffer size

Buffer size for the response without header (max 4kB).

Examples

SYN with window data:

d3 7e 00 00 08 00 42 30 00 00 08 34 0a 00 01 00 b7 1a 18 02

FIN + URG:

44 6a 00 00 00 00 49 30 ff ff 72 65
Clone this wiki locally