From be0fd7444ff714f3c654aca08b3bf151ac801bbf Mon Sep 17 00:00:00 2001
From: Vladimir Gavrilov <105977161+0xA50C1A1@users.noreply.github.com>
Date: Thu, 21 Mar 2024 16:38:47 +0300
Subject: [PATCH] Add more TencentGames signatures (#2354)

---
 src/lib/protocols/tencent_games.c             |   7 +++++++
 tests/cfgs/default/pcap/tencent_games.pcap    | Bin 2776 -> 6154 bytes
 .../default/result/tencent_games.pcap.out     |  19 +++++++++---------
 3 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/src/lib/protocols/tencent_games.c b/src/lib/protocols/tencent_games.c
index e10106d57db..12bde1b3745 100644
--- a/src/lib/protocols/tencent_games.c
+++ b/src/lib/protocols/tencent_games.c
@@ -73,6 +73,13 @@ static void ndpi_search_tencent_games(struct ndpi_detection_module_struct *ndpi_
       ndpi_int_tencent_games_add_connection(ndpi_struct, flow);
       return;
     }
+
+    if (ntohl(get_u_int32_t(packet->payload, 0)) == 0x4215F787 &&
+        get_u_int16_t(packet->payload, 6) == 0)
+    {
+      ndpi_int_tencent_games_add_connection(ndpi_struct, flow);
+      return;
+    }
   }
 
   NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
diff --git a/tests/cfgs/default/pcap/tencent_games.pcap b/tests/cfgs/default/pcap/tencent_games.pcap
index 1a14c48fd3c3cf25abadb2fdd57819135f912a09..96f5ad3fd66fe2f8e630d9c1ccbc390f45175d3a 100644
GIT binary patch
delta 3412
zcmZvfXE@dGAIHBq*|J9nWrmXxva*id!Ldg;8jihXbBMC%F;A#Cb_m%!60*r&onwTQ
z85+)?`ah}b_uzBg*ZsZj*X#N`ct3c5rx{~JUrm!E&5ys^QbS1rc>wr5YG;SGq7tA)
ztmj8QRZb9wwbQQe@n_3mQ9e9-0z4<g<IB4NfDpv@2}DRrE^3t1a{irwh=}amRX9Qg
zh@Rcg=gf6>oV&8R&OPTof42G_-!0#*Gv7CNIuH_Qx%fwR#slX9%5f?{;0!*WGl77%
z((h$r|5@hSndCE!1_)({1b%ay(^SA70q}d&0D?Vj<#SG_<3BkTAavFl08|)}N0CGu
zXWMsdlH@4{m-R@j7N_D<e_|IlIY9-+Glx)Fmh8NiX+*ncjCGrxyYnNLQ~slmRt>1#
zF#6h~YT+S@n%v1;Rvx1V^v`~V-LmOeB!f%^X_<PwVZ+Rcdj&iUiQIR)iV15HRY>ZA
zcul|W339flt-N9q3yxS)?#)96`0KAJr+3|KUj;?vUecat+($Kgg73a|9VP#oQj$`h
z&W3%vbg~??#{R|Qr-J6SyX`W5uaH*9rn-FC0l^`TA$lJAtXGOBpPDGCf@>2=UQ+)G
zLioiMy?Y_jsL4MiE}L?wQopjx90K?5NvEW&!)@S)ZSz8J$MagM$}*=RAK(|KZK^v2
z)Vz9r;8J!Az{!anv(0+kSA6_0;t0Jl7Krhld?#7W6|a1=(J?o{43BD&GE4glD{Qaj
zFf#{VCy##BHP;<T(}-&mwu=SQc=vG;9X}^Do(!3hjut2WEP`{q?R^*}6<&<<(bL#z
z^1#2+jB5~ce`DAv+ckIrdD?TUpwnyl>2vS|V;z?ggAe}}U+-#kQ^<v-k}v36TOwsC
z6(<+o>3q$9h^k4&g!h>94n>PUC6+ko1cT6AA@o@lkw(U&#xAe@&(i~%{X0GXkKg-$
z;`cd&1=0bdA;Kf66#&5E40PlK0jgxc?@<HDRR4fUmH!E{fPhx`d3?^&vw4<NfQ-f}
z`09YTpvHC4!e9J;T({}UL3k#Gxa`+YBXP`0Uu!$P^BIFUVO9+S<N1l!F`3*&=$EXp
zJE_Pvbr|<UF+aWpG5JbexU*>PE@aitOVPvDMMF&F1IPO*8{!qdcSC$6*CJB%%pTb@
z+7lk-IBdsq7PNY_CL?--g+jh5)!GcjiE;<h*F>1P8GgNw=OOifO#9Z+kyhNK=kVsG
zWy`m>U3DsEgyCp$hRx$<@&0dP<Cb75a99R%E=nmZXC-!#gbm|Aw!7Q3B$Zkop5xx}
zzD+#SxK%XX{IbwJUl}CK>vJHLv4##L99C0=63WbO)=7+b#yXKjro%`c_!0KT)YDjd
zfAgt4Rz|EW-ht3Ozhu<p#zoQ{%hFt@2?vh1sx{<7eP~CHK0({}(hIwto`V*}I&1bw
zRq5rRxJrm(-a3QT#5VlZjzwQHRb=!1GRs<>y|kg=ag1z6lZ|_3dXi-qo2MqdRu6Od
zYZ)2W2h@C!x%2~Pa<8IkF-m{gNiVif>KthA;u%Hl<_yDhbeUs`sOn6Z8o|d;C5J)H
zp@Z=>f(_7{8PnLviyC%{_O$~tcg9?iKz<9S@|1Rnzhhd(PP9p)s(uOI&d5oJWRGOu
z*n7oUFx?epM^byD>550(=J4hs%mX=DOs?d0rFRH#Wm=A4Coso_Qq7xP-{Z{L2@c3s
z4{=aGOHzhzYOQPWHkc6Bh>MX*(C01!s7wZKytgx_^b*shZ^xyupYBW$Z<RtMX9Dux
zeVqwOssRS8zT!q5_!wN>*R<Xml*YPDAt>+0@(D%H4%y!pwJ?<SUY~7a!iPUI(N`F2
z+@q>Dp?h|*a-nLueC-6W`q`L>c4Nm8+fuV-!xp1vGJKkMqr^SSz>SZAi=F#uY;(OF
zPaAuX2ANOnzqGQHU6HfBzI}?cZs>NqujO8VV|`pq7t}6zS9o**(QoC>xBX!C$7M$}
z$y~%`CatZtDlVQpDweK<ScxF%d$8&;hQYqkz{%{zCHIJ@zB97;;gc_RS%dy;g}8?=
zuMqU+8`#!q2gOzmEbp;{)4l)>)@cLi94w*(;YL26aNo1}G>N@&;VTJJ?mgu;iVph4
zMs$$xbg+uIUqaa+C88kfo_^_L0v5927fw75S*X2dP=l8yF>befM$pMP2<7UD#j3J^
zD0Qc{Z=sq+dS9`$IvQG}d2^rW8+|r?iST2iOWZUs7rT~{%sJFA>{(RkjFZeVPVK=+
zY6~dt#FQ^&8MyvrUMDI-G9JIneS}pT%0dZ$0V>;9;W^>bcjpR(lm-0eAzZfg=AqTP
zqbf%<*wM^{IwsA^Qmr+08XsDi!s@+kmklR;<ZbMliBYFfXq0`aE_w|M`l#-B5CJd3
zTf?&lb;k~jrZo0M2A9(+FH?EM>&exLThHeEKJ3>=p#+!Oymyhf^(XdRym4((v#8YG
z>n$gX^s=;YIXN$fP-mn`qYNAynN_^gcPU9<m!iR0WuPSJhtq{i`G()St#?1{?!5aH
zP6%-UsVcQ=Tk&k_Z=FEkm2;H0yX#;F8+H+;)e6(~xQaH!t9u@sX+2dD?aanT^>fps
zT4p09MaswZKkp!o=AVAyeFUx<%w~{F7i&}4FRrAvxgs#Cu3|J^sZ7S%`wMH#u1uOv
z1=U}#xGBXkBG<&5xzp=q;LCm*+YGkvDID#;c+iR{81}7A`>=7%hiz7fD5e~N$)FJ^
zt$dmCCSj-c^O9e^vje#41jz5zf3ssfa{KVb%Cb(1iCZ6%f<o({vv3-pn@zg<3#wqe
zn5b9MBoTnf^G0~h&bp8)3FR(C&c;c~2Zviorhk^mamC;yWtAzsyH9J%uYlB(7%{nA
z#_UBDniKhuU^ST%idn{wp^;19OYswI5k+mzd#@|0LfO|cnfXSOy9?$_nI?QjlU*~0
z`9N|wLwe)|Nsm#2)!LC^-vGVOV+Rz`>Ln-9GmPJi{EUBTe<&i{Ojw!>F_q9X{RRM+
zt_cRP_+On+xt|w+qT^r_li^W~PtQr+ROb$j*316z_#u(WsVtXbrB<F<m(v}P{v9IW
zi%nlA=))h$$&N<38e$CMp{csJs7U7GfXS<gLaa_mjSO=iv_)kxoXC2A<Mq7duXi=+
z&Ur^CM$T~?puobaX<m0V@KLDvftgLn_)5iO|FJoI^T52;;9j6+W5W?Kaduu%$Z&&-
zu}ZLTH;R0ItE{RZMj?HN-oIP5vVq^G|5yhhJi_icJ2~g&ix)Kf*lV&u*Gi3{SaUNe
zLqL)3YI-(+M3gib1)*_$wgo)`LF+aoQQGX}WU_Yb#7B*08j7|Jev<?bHEP;xrxH~C
zq>7_zo~TFeKWF%uR5o#pSi0`XQ8^A7=4`WM_%+i6&E0-MIKNir1Svcr2Y;kz?Z)+P
z+|`Zk+AhBa_ZTVQkndSieyPA8Mv5pyi6L|C_DD{XA8TNtE?;A-vwvJ8Xu|FXwC}*|
z`B5mInI{JFCy+3ea;dho%Zx<5OrVKsN?!Q-D^oT1@5{`3F{Nw#-_`s5MXo<5JCqFQ
zUzwvZP)*Jj<XZgMMORB`GvRq^<uRsqBaaAu73uJNL`4fLKxw9-DrZ&2KqPr`8i?f4
z?u(SpcQj1{5q^k{{yEo#2mzURlyBZjW`CjL$RuFapH`$JZW~_(8#x{CR7#5T#ltjg
zSbk8T6C77l9}Q5i6UYa(x{Fr1aWh6Km9`I(*ZT14BTS{--WG=A0}~2v^_ERbS=ymb
zbechAFOHE`IBMF3ggXv5Zq!UHY9VdsN4gP>A>!D_`X<i?_$4|GW)7F2`skJy@AvOS
zc?tOPadOrzdb<Y(CJt{?>lomtT7yZ*F#94Pk)UGFlGHc0)#%Ase<M`+s&vRE`}!QU
z(evA~4Wmr(Xj3e+qYlo6=}p|?WNEUrLJmd`bs&`1%uC5249;iZ@o8l0LcV?Sc6xw-
z#jsE+)z#OX8#MHQ+oAbWyeA~cznq-h^7}B@Z1LqZPOjJINAnE5CG3SFBQe1Zd2y;L
z{gWm)UwF%#R%rg1v0%@FZe6M87gpr}@b!j_poZZLJLC`a_B(cvSHOfrXN#l6dCQ{X
z0{va?kt)C2ee~Zg9n#^u6-Ij2?qkR@{?s$?e?iD^F6uuy+A}Ww50~-}_irDB{`nsX
gBRwmGo#%y+_{ty9C!6fAP5%Y|;%GqtF(&~051fiP0ssI2

delta 7
OcmeA&xFNdX1{VMgLjyVh

diff --git a/tests/cfgs/default/result/tencent_games.pcap.out b/tests/cfgs/default/result/tencent_games.pcap.out
index 67eeeb314e6..481ec018469 100644
--- a/tests/cfgs/default/result/tencent_games.pcap.out
+++ b/tests/cfgs/default/result/tencent_games.pcap.out
@@ -1,6 +1,6 @@
-DPI Packets (TCP):	12	(4.00 pkts/flow)
-Confidence DPI              : 3 (flows)
-Num dissector calls: 432 (144.00 diss/flow)
+DPI Packets (TCP):	16	(4.00 pkts/flow)
+Confidence DPI              : 4 (flows)
+Num dissector calls: 576 (144.00 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/0/0 (insert/search/found)
 LRU cache zoom:       0/0/0 (insert/search/found)
@@ -18,13 +18,14 @@ Patricia risk mask:   0/0 (search/found)
 Patricia risk mask IPv6: 0/0 (search/found)
 Patricia risk:        0/0 (search/found)
 Patricia risk IPv6:   0/0 (search/found)
-Patricia protocols:   3/3 (search/found)
+Patricia protocols:   4/4 (search/found)
 Patricia protocols IPv6: 0/0 (search/found)
 
-TencentGames	22	2400	3
+TencentGames	32	5618	4
 
-Fun                             22 2400          3            
+Fun                             32 5618          4            
 
-	1	TCP 10.215.173.1:42864 <-> 162.62.116.201:20731 [proto: 395/TencentGames][IP: 285/Tencent][ClearText][Confidence: DPI][DPI packets: 4][cat: Game/8][4 pkts/951 bytes <-> 2 pkts/88 bytes][Goodput ratio: 81/0][0.23 sec][bytes ratio: 0.831 (Upload)][IAT c2s/s2c min/avg/max/stddev: 32/124 75/124 124/124 38/0][Pkt Len c2s/s2c min/avg/max/stddev: 40/40 238/44 473/48 191/4][Plen Bins: 0,0,0,0,0,0,0,0,0,0,50,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
-	2	TCP 10.215.173.1:43300 <-> 43.130.19.227:65010 [proto: 395/TencentGames][IP: 285/Tencent][ClearText][Confidence: DPI][DPI packets: 4][cat: Game/8][5 pkts/413 bytes <-> 5 pkts/405 bytes][Goodput ratio: 47/49][0.61 sec][bytes ratio: 0.010 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 4/4 103/104 200/200 95/96][Pkt Len c2s/s2c min/avg/max/stddev: 40/40 83/81 157/173 46/52][PLAIN TEXT (9089499565149320430)][Plen Bins: 0,0,50,25,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
-	3	TCP 10.215.173.1:46658 <-> 162.62.97.166:8085 [proto: 395/TencentGames][IP: 285/Tencent][ClearText][Confidence: DPI][DPI packets: 4][cat: Game/8][3 pkts/290 bytes <-> 3 pkts/253 bytes][Goodput ratio: 52/49][0.17 sec][bytes ratio: 0.068 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 7/8 51/40 95/71 44/32][Pkt Len c2s/s2c min/avg/max/stddev: 40/40 97/84 190/165 66/57][PLAIN TEXT (gcloud)][Plen Bins: 0,0,0,50,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	1	TCP 10.215.173.1:47046 <-> 129.226.103.74:31003 [proto: 395/TencentGames][IP: 285/Tencent][ClearText][Confidence: DPI][DPI packets: 4][cat: Game/8][5 pkts/678 bytes <-> 5 pkts/2540 bytes][Goodput ratio: 67/92][1.09 sec][bytes ratio: -0.579 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 181/121 362/362 181/170][Pkt Len c2s/s2c min/avg/max/stddev: 40/40 136/508 498/2372 181/932][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50]
+	2	TCP 10.215.173.1:42864 <-> 162.62.116.201:20731 [proto: 395/TencentGames][IP: 285/Tencent][ClearText][Confidence: DPI][DPI packets: 4][cat: Game/8][4 pkts/951 bytes <-> 2 pkts/88 bytes][Goodput ratio: 81/0][0.23 sec][bytes ratio: 0.831 (Upload)][IAT c2s/s2c min/avg/max/stddev: 32/124 75/124 124/124 38/0][Pkt Len c2s/s2c min/avg/max/stddev: 40/40 238/44 473/48 191/4][Plen Bins: 0,0,0,0,0,0,0,0,0,0,50,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	3	TCP 10.215.173.1:43300 <-> 43.130.19.227:65010 [proto: 395/TencentGames][IP: 285/Tencent][ClearText][Confidence: DPI][DPI packets: 4][cat: Game/8][5 pkts/413 bytes <-> 5 pkts/405 bytes][Goodput ratio: 47/49][0.61 sec][bytes ratio: 0.010 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 4/4 103/104 200/200 95/96][Pkt Len c2s/s2c min/avg/max/stddev: 40/40 83/81 157/173 46/52][PLAIN TEXT (9089499565149320430)][Plen Bins: 0,0,50,25,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	4	TCP 10.215.173.1:46658 <-> 162.62.97.166:8085 [proto: 395/TencentGames][IP: 285/Tencent][ClearText][Confidence: DPI][DPI packets: 4][cat: Game/8][3 pkts/290 bytes <-> 3 pkts/253 bytes][Goodput ratio: 52/49][0.17 sec][bytes ratio: 0.068 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 7/8 51/40 95/71 44/32][Pkt Len c2s/s2c min/avg/max/stddev: 40/40 97/84 190/165 66/57][PLAIN TEXT (gcloud)][Plen Bins: 0,0,0,50,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]