From 599cc0f4b83a96c247a92aaaa3f39acfec9e1dbe Mon Sep 17 00:00:00 2001
From: Vladimir Gavrilov <105977161+0xA50C1A1@users.noreply.github.com>
Date: Thu, 28 Mar 2024 18:01:01 +0300
Subject: Improve LoL: Wild Rift detection (#2359)

---
 src/lib/protocols/lol_wild_rift.c | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

(limited to 'src')

diff --git a/src/lib/protocols/lol_wild_rift.c b/src/lib/protocols/lol_wild_rift.c
index 214c74dcb..eb0328112 100644
--- a/src/lib/protocols/lol_wild_rift.c
+++ b/src/lib/protocols/lol_wild_rift.c
@@ -31,6 +31,14 @@
 #include "ndpi_api.h"
 #include "ndpi_private.h"
 
+static void ndpi_int_lolwildrift_add_connection(struct ndpi_detection_module_struct *ndpi_struct, 
+                                                struct ndpi_flow_struct *flow)
+{
+  NDPI_LOG_INFO(ndpi_struct, "found League of Legends: Wild Rift\n");
+  ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_LOLWILDRIFT,
+                             NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
+}
+
 static void ndpi_search_lolwildrift(struct ndpi_detection_module_struct *ndpi_struct,
                                     struct ndpi_flow_struct *flow)
 {
@@ -38,6 +46,14 @@ static void ndpi_search_lolwildrift(struct ndpi_detection_module_struct *ndpi_st
 
   NDPI_LOG_DBG(ndpi_struct, "search League of Legends: Wild Rift\n");
 
+  if (packet->payload_packet_len == 22 &&
+      ntohl(get_u_int32_t(packet->payload, 0)) == 0x102C841 &&
+      ntohl(get_u_int32_t(packet->payload, packet->payload_packet_len-4)) == 0x41304231)
+  {
+    ndpi_int_lolwildrift_add_connection(ndpi_struct, flow);
+    return;
+  }
+
   if (packet->payload_packet_len == 69 &&
       ntohl(get_u_int32_t(packet->payload, 0)) == 0x4000000)
   {
@@ -49,10 +65,7 @@ static void ndpi_search_lolwildrift(struct ndpi_detection_module_struct *ndpi_st
       packet->payload_packet_len == 359 &&
       ntohl(get_u_int32_t(packet->payload, 0)) == 0x10000000)
   {
-    NDPI_LOG_INFO(ndpi_struct, "found League of Legends: Wild Rift\n");
-    ndpi_set_detected_protocol(ndpi_struct, flow,
-                               NDPI_PROTOCOL_LOLWILDRIFT, NDPI_PROTOCOL_UNKNOWN,
-                               NDPI_CONFIDENCE_DPI);
+    ndpi_int_lolwildrift_add_connection(ndpi_struct, flow);
     return;
   }
 
-- 
cgit v1.2.3