Sunday, July 4, 2010

Reversing an RF Clicker

by Travis Goodspeed <travis at radiantmachines.com>
concerning the Turning Point ResponseCard RF,
having FCC ID R4WRCRF01,
patented as USA 7,330,716.


Turning Point Clicker

In this article, I describe in detail the methods by which I have reverse engineered the TurningPoint ResponseCard RF, casually known among students as a "Clicker". This 2.4GHz radio transceiver is used in undergraduate university classrooms for automated roll-call and in-class quizzing or voting. By dumping and analyzing its firmware, one can determine the radio protocol necessary to intercept and forge packets, as well as to build a custom base station. The radio hardware that I have used is a reprogrammed Next HOPE Badge running the GoodFET firmware.

A follow-up article will likely describe the writing of replacement firmware, but that can be easily enough discovered by an enterprising reader. My purpose instead is to provide the information necessary to build compatible products, as well as to teach the technique of reverse engineering these products to find such information when none is available.

Disassembly


The Clicker's keypad is attached only with adhesive, and it can be pulled off after lifting an edge with a knife blade. Beneath the keypad, there are four screws holding the board in place, plus a fifth from the rear of the device. If you are lucky, these will be small Phillips screws, but the unlucky will find tri-wing "Nintendo" screws. I was lucky to have one of each type, but those with neither a Phillips-screwed Clicker nor a tri-wing screwdriver can buy one or try one of these tricks.
Devil Screws

In either case, it isn't strictly necessary to open your clicker, as test-points for dumping and replacing its firmware are accessible from the battery compartment. Further, the radio communications are accessible with no hardware access whatsoever.

Hardware


The Clicker is built upon a Nordic nRF24E1 chip, which combines an 8051 microcontroller with an nRF2401 radio transceiver. Although the two cores have been combined into a single package, the 8051 core speaks to the radio through a few bit-field registers and an internal SPI bus, which is shared with the external SPI bus.

As the nRF24E1 lacks internal non-volatile storage, a CAT25C32 (pdf) SPI EEPROM is used for program and configuration storage. Within the microcontroller, there is a masked ROM bootloader from 8000h to 81FFh that loads executable code from the EEPROM into executable RAM from 0000h to 0FFFh.

Hacked Clicker Board

Dumping Firmware


At the base of the circuit board's primary side, there are test points for the SPI EEPROM. As the default firmware only uses the SPI bus when buttons are pressed, this EEPROM may be dumped at any point after the device has booted. The test points are as follows, which should be matched to those of equivalent names in the GoodFET SPI Table. They were determined by use of a continuity tester.
T4MISO
T5SCK
T6MOSI
T3!CS
T1VCC
GNDGND


In order to dump the firmware, I quickly wrote a GoodFET client for the 25C32 using its datasheet. A read is performed by sending {0x02, AL, AH, 0} as a SPI transaction, with the result coming back as the fourth byte. Doing it this way with the GoodFET's SPI driver is slower than having C code within the GoodFET dump the whole ROM, but it's fast enough for a dump and takes very little code.
Quick and Dirty 25C32 Driver

From this point, I dumped the firmware with 'goodfet.spi25c dump image.hex', converted the Intel Hex file to binary, and popped it open in Emacs/hexl. The result looks something like the following, whose format is described in the nRF24E1 datasheet. The opening passage is {u8 config, u8 entry offset, u8 blockcount}. Here {0x0B, 0x07, 0x0B} means that executable code begins at byte 0x07, and that the total image length is 0x0B*256==2,816 bytes. (Additional space within the SPI ROM is unused and left as 0xFF.)
Clicker ROM

To produce an image suitable for a disassembler, I cut the bytes before 0x07 to make an image beginning with {0x02, 0x0A, 0xB7, ...}. The extra bytes in this region are the serial number and default frequency, but we'll get back to that later.
Clicker Dev Kit

Firmware Analysis


As the firmware is only three kilobytes, it doesn't take terribly long to reverse engineer. First, the Special Function Registers (SFR) which are defined on pages 79 and 81 of the nRF24E1 datasheet are fed to the disassembler.

(I'm using IDA Pro here, but any 8051 disassembler with a decent text editor could suffice. All of the following function labels are from my imagination, while Special Function Registers (SFRs) come from the nRF24E1 datasheet.)

For example, "MOV 0xA0, #0x80" is rather opaque, but "MOV RADIO, #0x80" makes it clear that the immediate value 0x80 is being placed into the RADIO register. Page 89 of the datasheet will then explain that the high bit of the radio register is power control, so this instruction is powering up the radio for use. Similarly, "SETB RADIO.3" is setting the fourth bit of the RADIO register, which the datasheet describes as raising the CS signal.

Once the SFR addresses are known, it becomes useful to search for them in order to identify the I/O routines. In the nRF24E1, the radio is accessed across a SPI bus, so a good first step is to identify the SPI routine. The function containing this code will always include a MOV involving the SPI_DATA register.
SPIRXTX for 8051

Having this, a list of cross-references quickly shows that while few functions call the SPIRXTX function, each calls it many times. This is because the author has chosen to repeatedly call that function with immediate values, rather than to dump an array of bytes with a for(){} loop.
Functions calling SPITXRX

While the disassembler can automatically identify the function entry points in the table above, it is not capable of giving them English names or descriptions. To understand how this is done, it is necessary to read the datasheets of the SPI devices.

The SPI EEPROM chip, a CAT25C32, is used by dropping the !CS line then writing an opcode byte followed by its parameters or results. Opcodes include WREN/WRDI for write protection, RDSR/WRSR for accessing a status register, and READ/WRITE for reading and writing bytes. A WRITE may only be performed when the external !WP pin is low and the software write protect has been disabled by opcode. A transaction begins when !CS drops low and ends when it drops high.

To identify the function which reads a byte from the 25C32, a few things can be safely assumed: (1) The function will begin by dropping some I/O pin (!CS). (2) The function will then broadcast the READ opcode, 0x03. (3) It will then broadcast a sixteen bit parameter; that is, DPL followed by DPH. (4) Finally, it will return the result of a fourth SPIRXTX call. In pseudocode, that would be something like
SPIROMPEEK(u16 ADR){
SPIRXTX(0x03);
SPIRXTX(ADRL);
SPIRXTX(ADRH);
return SPIRXTX();
}


Sure enough, one of the few functions calling SPIRXTX does exactly this. The constant pushing and popping of the parameters is a quirk of the compiler, which might possibly allow it to be identified. From the code below, it is clear that P0.0 is the !CS line of the CAT25C32.
SPIROMPEEK

The SPIROMPOKE function looks similar, except that two transactions are performed. First the WREN (0x06) opcode is sent to enable writing, then WRITE (0x02) is used to perform the actual write.

The other SPI operations concern the nRF2401 radio core, which behaves differently from the EEPROM. Rather than transactions being an opcode followed by parameters, there is only a single SPI register that must be completely written during a transaction. A second register, selected by the CE line, contains the packets.

The configuration is set by one big register, sent MSBit first. If fewer than the needed bytes are sent, the value is right-aligned into the lower bytes of the register. That is, the last byte sent is always (CHAN<<1)|RXMODE and the second to last always describes the radio configuration.
nRF2401 Config Register

Searching around a bit yields the RADIOWRCONFIG function, the tail of which is below. It can be seen from the code that the 0x1A IRAM byte holds the channel number. That is, if 0x20 is stored at 0x1A, the radio will be configured to 2,432 MHz. The other configuration bytes reveal that the MAC addresses are 24 bits, the checksum is 16 bits, and the device broadcasts at maximum power sourced from a 16MHz crystal. (That the configured crystal is identical to the one on the board is very important. Some enterprising coders will lie to a chip about its crystal in order to access an unsupported radio frequency.)
Clicker RF Config

At this point, it still remains to sniff traffic is to find the target address to which packets are broadcast as well as the frequency. We'll start with the address, because that's a bit easier.

The TXPACKET function involves a lot of PUSH and POP instructions, but it otherwise looks very similar to the RADIOWRCONFIG function, in that a series of bytes are written in order with repeated function calls to SPIRXTX. In pseudocode, this function becomes the following. From the radio documentation and configuration, it is clear that the first three bytes will be the target MAC address. From the RADIOWRCONFIG() function, it is equally clear that the three bytes at 0x1B are the receiving MAC address of the unit. (The parameter of the function happens to be the button press, as can be determined by tracking the keyboard I/O routines or viewing a few packets.)
void TXPACKET(u8 button){
RADIOHOP(); //set channel

//Target MAC address
SPIRXTX(&0x1E);
SPIRXTX(&0x1F);
SPIRXTX(&0x20);

//Source MAC address
SPIRXTX(&0x1B);
SPIRXTX(&0x1C);
SPIRXTX(&0x1D);

//Data value
SPIRXTX(button);
}

The radio itself will append a 16-bit CRC; therefore, the full packet then becomes {u24 tmac, u24 smac, u8 button}.

To determine the value of the target MAC address, just grep the disassembly for "mov" and one of 0x1E, 0x1F, 0x20. The relevant instructions are as follows, setting the target MAC address to 0x123456. (In 8051 notation, the first instruction moves the immediate constant #0x12 into byte 0x1E of IRAM.)
mov 0x1E, #0x12
mov 0x1F, #0x34
mov 0x20, #0x56


As this point, it would be possible to scan each channel for a few seconds, listening for packets sent to that address, but it's classier to find the value by static analysis. Acting on the hunch that the configuration is held in EEPROM and looking for references to the SPIROMPEEK() function, the READIDFREQ() function can be found. As can be seen in the fragment below, EEPROM[6] holds the channel number while the MAC address is at EEPROM[3,4,5].
Clicker Config

As the EEPROM begins with "0b 07 0b 15 79 1b 29", it's clear that the MAC address of the unit from which it came is 0x15791B and that it is broadcasting on 2400+0x29=2441MHz. This can be double-checked by the serial number "15791B" being printed on the label.

Implementation


Knowing the modulation scheme, target address, and packet contents, it becomes possible to sniff traffic from a Clicker. This is performed by use of the GoodFET firmware on a Next Hope badge, my prior tutorial for which describes the process of packet sniffing.

The NHBadge board contains an nRF24L01+ radio, which differs dramatically from the nRF2401 in terms of how it is configured. Still, the radios are sufficiently compatible. The following hack of the goodfet.nrf client allows packets to be sniffed from the air with proper checksumming.
Sniffing TurningPoint Traffic

Sure enough, here are some packets of the 5 button being pressed on unit 1F8760. The keypress is the final byte in ASCII.
Clicker Sniffing

Response Codes



Now that it is clear how to receive and recognize button presses, it becomes necessary to reverse engineer the response codes which might be sent from the access point. Without hearing a reply of at least an ACK, the Clicker will continue to broadcast each message more than three hundred times. This takes more than ten seconds, during which all other key presses are ignored.

The broadcast loop within the MAIN() function would look a little like this in C.
for(count=0;count< MAXCOUNT && !reply;count++){
TXPACKET(button);
reply=RADIORX();
}
switch(reply){...}


This region is easy enough to find, but there's another command mode. An easier target is the channel hopping routine, which constantly broadcasts 0x3F while incrementing the channel, sticking with the last one on which a reply of 0x18 was received. Channels 1 through 83 are attempted; that is, 2,401 MHz to 2,483MHz at 1MHz steps.
Clicker SYN/ACK

Checking this code within the MAIN() function reveals that its effect is to blink the green LED (P1.1) six times, exiting the broadcast loop. Other commands include 0x04 (LED Off), 0x06 (LED Green), 0x15 (LED Red), 0x11 (Blink Green), 0x14 (Blink Red), and 0x18 (Blink Green, Channel Lock). All undefined opcodes set the red LED.

Conclusions


By sniffing traffic within a classroom, it is possible to watch votes as they are being cast by students. Similarly, packets could be broadcast by a reprogrammed Clicker or NHBadge to make a student in virtual attendance, automatically voting with the majority so as to gain perfect attendance and a solid C quiz average. Where instant feedback is available, this might even allow for a solid A quiz average. Without taking advantage of the masked-ROM option of the nRF24E1, the code cannot be even slightly protected from extraction and reverse engineering.

Less adventurous users can jam the network by running 'goodfet.nrf carrier 2441000000' to hold a carrier wave on the channel. The only attempt at a frequency change is made when pressing the GO button, at which point the new channel can be discovered and similarly jammed.

Since performing this work, it has come to my attention that a USRP plugin for doing this to the competing 900MHz iClicker product is available as http://gr-clicker.sourceforge.net/. Additionally, the infrared Clicker units were broken with a little tool called Survey Says. I have ordered more sophisticated Clicker models from CPS and Turning Point, and proper descriptions of them will soon follow.

225 comments:

  1. If the EEPROM bus is shared with the SPI bus, it might also be possible to sniff the traffic to the radio. I'll be getting some ATMega128RFA1 chips soon so I'll be looking into this on that chip as well.

    ReplyDelete
  2. This comment has been removed by a blog administrator.

    ReplyDelete
  3. Hi

    Very nice work.
    I think i gonna often come back.

    ++

    ReplyDelete
  4. This comment has been removed by the author.

    ReplyDelete
  5. Awesome job! I was actually wondering how difficult this would be while i was in math class last week. It's past my skill level, but hopefully I can work on this in the future. My class uses the "iClicker" which operates at 915MHz, but it's a similar concept I suppose. Thanks again for the great write up!

    ReplyDelete
  6. Akiba,

    You're right that the transactions might be leaked over the SPI bus, with the exception of the Slave Select line that would be internal-only.

    Let me know what you find with the ATMega.

    --Travis

    ReplyDelete
  7. This comment has been removed by a blog administrator.

    ReplyDelete
  8. You want a job? Wanna do this and learn some ruby on the side?

    You rock.

    -The guys from Poll Everywhere
    http://www.polleverywhere.com

    (We're the other guys tearing up clickers for fun)

    ReplyDelete
  9. This comment has been removed by a blog administrator.

    ReplyDelete
  10. This comment has been removed by a blog administrator.

    ReplyDelete
  11. This comment has been removed by a blog administrator.

    ReplyDelete
  12. This comment has been removed by a blog administrator.

    ReplyDelete
  13. This comment has been removed by a blog administrator.

    ReplyDelete
  14. This comment has been removed by a blog administrator.

    ReplyDelete
  15. This comment has been removed by a blog administrator.

    ReplyDelete
  16. This comment has been removed by a blog administrator.

    ReplyDelete
  17. Has TurningPoint suggested that they would improve security on these devices or will they simply pretend it is not a problem?

    BTW: great work...

    ReplyDelete
  18. This comment has been removed by a blog administrator.

    ReplyDelete
  19. This comment has been removed by a blog administrator.

    ReplyDelete
  20. This comment has been removed by a blog administrator.

    ReplyDelete
  21. This comment has been removed by a blog administrator.

    ReplyDelete
  22. This comment has been removed by a blog administrator.

    ReplyDelete
  23. This comment has been removed by a blog administrator.

    ReplyDelete
  24. This comment has been removed by a blog administrator.

    ReplyDelete
  25. This comment has been removed by a blog administrator.

    ReplyDelete
  26. This comment has been removed by a blog administrator.

    ReplyDelete
  27. This comment has been removed by a blog administrator.

    ReplyDelete
  28. This comment has been removed by a blog administrator.

    ReplyDelete
  29. What GoodFET controller do you use to interface with the SPI?

    ReplyDelete
  30. Howdy Me,

    Any GoodFET model will do, even the old MSP430F1612 devices (GoodFET11) or the NHB12 itself.

    --Travis

    ReplyDelete
  31. Hi Travis, I was wondering if you have attempted any more hacks with the newer models of the turning point clickers?

    Thanks from a fellow hacker,
    -Kevin

    ReplyDelete
  32. Always voting with the majority would probably get you an A. The majority gets each question right, but the individuals making up that majority changes each question such that the individuals average a C or whatever.

    ReplyDelete
  33. Always voting with the majority would probably get you an A. The majority gets each question right, but the individuals making up that majority changes each question such that the individuals average a C or whatever.

    ReplyDelete
  34. Excellent post. I want to thank you for this informative read. Keep up your great work. PCB Fabrication

    ReplyDelete
  35. hello sir ,can you tell me about the receiver how can i make receiver for multiple transmitter

    ReplyDelete
  36. Nice Blog, Visit for the best SEO Service and Website Designing and Development for your business.
    SEO Service in Delhi

    ReplyDelete
  37. For the best Mutual fund Investment and for the best Mutual fund Schemes Visit Mutualfundwala.
    Mutual Fund Agent
    Mutual Funds India

    ReplyDelete
  38. For best sound and audio engineering course visit our website spingurus.
    audio engineering courses

    ReplyDelete
  39. La veilleuse coranique bluetooth avec sa télécommande pour offrir.
    Cadeau ramadam idéal
    La veilleuse coranique personnalisée pas cher
    Veilleuse coranique personnalisée
    Veilleuse coranique personnalisée

    ReplyDelete
  40. Thank you very good article! You may be interested in products: sapphire stone (đá sapphire), emerald stone (đá emerald), ruby ​​red stone (đá ruby đỏ)

    ReplyDelete
  41. It’s in reality a great and useful piece of information. I am happy that you simply shared this helpful info with us. Please keep us informed like this. Thank you for sharing.

    Structural Analysis in UK
    Structural Analysis in India

    ReplyDelete
  42. Thank you very good article! You may be interested in products: teach math for 4-year-old children( dạy toán cho trẻ 4 tuổi),developing mathematical thinking for children( phát triển tư duy toán học cho trẻ)

    ReplyDelete
  43. Bài viết bạn rất hay:



    Chúng tôi là đơn vị cung cấp các sản phẩm chất lượng như:



    lều xông hơi



    lều xông hơi sau sinh



    lều xông hơi giá bao nhiêu




    ReplyDelete

  44. Vanskeligheter( van bi ) vil passere. På samme måte som( van điện từ ) regnet utenfor( van an toàn ) vinduet, hvor nostalgisk( van bướm ) er det som til slutt vil fjerne himmelen.

    ReplyDelete
  45. Web Designing and Web Development are two different fields and “JeewanGarg” the Website Designing Company in Delhi has both procedures under one roof. You have no need to look any further because we have a complete team of professionals including persons who experts in Photoshop, Illustrator, and relevant designing tools used today.

    ReplyDelete
  46. For Best private ambulance call at Almas ambulance service in Delhi. We help patients to get best medical care on right time by our ambulance service.
    http://www.almasambulance.com
    International air ambulance
    Air ambulance Kolkata
    Air ambulance guwahati
    Air ambulance patna
    Air ambulance ranchi
    Air ambulance srinagar
    Air ambulance Delhi

    ReplyDelete
  47. Nice blog, Get you website designing responsive and creative and also digital marketing services at ogen info system Delhi, India.
    Dynamic Website Designing Company in Delhi

    ReplyDelete
  48. Agar aap apne husband se pareshan hai or uss se door rhana cahati hai toh aap Talaq lene ki dua ko kijiye aap pati aapko khud ba khud talaq de dega

    ReplyDelete
  49. thanks for sharing a informative blog. @http://www.airoshotblast.net/

    ReplyDelete
  50. Web, Mobile, Cross-Platforms Solutions
    Thanks For sharing an informative blog keep rocking bring more details
    Google ads company

    ReplyDelete
  51. Thank you for this text it’s nice and perceptive. immeasurable awe-inspiring stuff in here I hope you'd prefer to take a glance at our website regarding the tiny known secrets of checkout flows that convert like thunder. If so, here’s the link:

    Best web design company in chennai
    Web Development Company in Chennai

    ReplyDelete
  52. If your Dell printer is offline windows 10, make a call to our customer support team to get 24*7 instant support to make your experience better with dell Printer.

    ReplyDelete
  53. Pioneer Filmz have set a benchmark hard to match. It is the video production and film production company by far. They have expertise in production of Documentary films, corporate films and Ad films, promotional videos and all other type of creative videos. More details visit https://pioneerfilmz.com/

    ReplyDelete
  54. Remote Monitoring and Control system
    SCADA Base Remote Monitoring
    best website development company in noida
    Greetings! Very helpful advice within this post! It is the little changes that produce the most important changes. Thanks a lot for sharing!`

    ReplyDelete
  55. Nice blog, thank you so much for your efforts. If you are looking for a creative web designer in Delhi, ogen infosystem provides one of the best and professional web designing services in delhi, India.
    Top 5 Website Designing Company in India

    ReplyDelete
  56. This comment has been removed by the author.

    ReplyDelete
  57. ES File Explorer/Manager PRO Multifunctional file manager with support for all file -

    ReplyDelete
  58. آیا پزشک هستید و به دنبال ترجمه تخصصی پزشکی می گردید ؟ آیا روانشناس هستید و به دنبال ترجمه تخصصی روانشناسی میگردید ؟ آیا مهندس کامپیوتر هستید و به دنبال ترجمه تخصصی کامپیوتر می گردید ؟ کار ما ترجمه تخصصی مقاله است. با خیال راحت مقاله های خود را به ما بسپارید.

    ReplyDelete

  59. Thanks for sharing such a great information, Here we are India's best service provider of SBI Kiosk Banking.
    sbi kiosk banking
    sbi kiosk
    csp bank mitra
    kioskonlinesbi
    kiosk sbi
    sbi kiosk online
    sbi csp

    ReplyDelete

  60. Very Impressive post, really this is very informative post. While the world is turning acidic, alkaline water is the new food solution trend hitting all over the world.Buy only the best Alkaline water machine with 100% of effectiveness from the leading Water ionizer india. A powerful machine that helps to fight against osteoporosis and Cancer from acidic water.

    For More Information Visit Us:
    Water ionizer machine
    Alkaline water machine india
    alkaline water ionizer machine in india

    ReplyDelete
  61. Nice blog, thanks for sharing this. If you need a professional website development services in delhi, Dial Web India is best for you.
    Best Website Development Company in India

    ReplyDelete
  62. i found this article more informative, thanks for sharing this article!
    showbox
    showbox for pc

    ReplyDelete
  63. Sand Blasting Machine India s Leading manufacturer of Portable Sandblasting Equipment, sandblasting machine for sale exporters at low cost best quality

    ReplyDelete
  64. Sarswati Enterprises provides the high quality Screw Caps Making Machinery and Aluminum Caps Making Machinery at low budget.
    Screw Caps Making Machinery

    ReplyDelete
  65. Hello everyone , here’s your opportunity for you to achieve your dreams of being a multi million dollar rich through trading , I once loss all I got through trading but was fortunate to come across a woman with great virtue and selfless heart (Mary ) i was introduce to her masterclass strategy while searching online which has revived me of all my losses and made me gain more and more . With her unique strategy you are entitled to daily signals and instant withdraw ,be rest assured of getting a refund of all your loss investment with any platform that has denied you in one way or the other in getting your money . Mrs Mary masterclass strategy is simply the best for beginners and those that are finding it difficult to succeed through trading she’ll help you with just a simple step . Email her ( maryshea03 @ Gmail .com) WhatsApp +1 562 384 7738 . Remember this is absolutely free!!!

    ReplyDelete
  66. This blog is so good keep it up ....nice blog!
    Regards:

    AC Repair Dubai

    ReplyDelete
  67. Great blog, thanks for sharing with us. Meritidevisa has experienced visa consultants in Delhi. Get the best Immigration consultants in Delhi for Hong Kong, Canada, Australia, UK, and New Zealand.
    Best Immigration Consultants in Delhi

    ReplyDelete
  68. Nice blog, thanks for sharing this. Noble IVF is of the leading Test Tube Baby Centre in Aligarh. For more information visit our website.
    Test Tube Baby Centre in Aligarh

    ReplyDelete
  69. Really nice, thank you so much for sharing this. Visit Kalakutir Pvt Ltd for the best Indoor & Outdoor Advertising and Interior and Exterior Painting of Industrial in Delhi, India.
    Indoor & Outdoor Advertising

    ReplyDelete
  70. Keep it up for more updates. Protrek Adventure provides Annapurna Base Camp Trek, one of the best camp treks in Annapurna region and Sandakphu Trek is the highest peak in west bengal.
    Annapurna Base Camp Trek

    ReplyDelete
  71. Amazing blog, thank you so much for sharing this blog. Visit Gribety Detective India for professional Detective Agency in Jaipur.
    Detective Agency in Jaipur

    ReplyDelete
  72. Hi,
    Excellent blog,
    Really a good information.

    Thank You

    ReplyDelete
  73. Post is very good thanks sharing its very awesome post thankyou..Now no more worries about unemployment as RRB Recruitment 2020 is here to provide you all the information related to Sarkari Naukri. All you can get at Sarkari Result is the latest updates on, Govt Jobs, Sarkari exams, Sarkari jobs, Admit Card, Answer Keys, and Sarkari Results and may more...

    ReplyDelete
  74. Its really great being a content writer I can understand how tough is it to write and develop the content ,Thanks for sharing this wonderful information. We are provider of SAP Training in LucknowDigital marketing training in Lucknow. We also provideAUTOCAD Training in Lucknow  ,
      PYthon Training in LucknowSAP FICO Training in Lucknow and 
      PHP Training in Lucknow  

    ReplyDelete
  75. Readyreviews is India's leading online platform in providing Best Product Reviews Buying Guides in India & Recommendations of Electronics & Gadgets, Home & Kitchen appliances, Wearable devices, Fashion, Musical Instruments, Health & Fitness.

    Best Product Reviews Buying Guides in India

    ReplyDelete
  76. Samay Bhaskar is leading No. 1 Firozabad News Hindi Live Paper comes with Latest and Breaking News Samachar in Hindi from Politics, World,Sports,National,Entertainment, Lifestyle, Agra, Firozabad, Noida,Mumbai,Lucknow and more.

    Firozabad News Hindi Live

    ReplyDelete
  77. latest hindi bollywood news - Check out the latest Bollywood news, hindi bollywood news today, box office collection updates, reviews & trailers of bollywood movies.

    latest hindi bollywood news

    ReplyDelete
  78. As mentioned above, being able to hire freelancers swiftly and easily helps businesses to save money. It’s one of those things that’s made a lot simpler and more efficient by using Field Engineer. messy data center

    ReplyDelete



  79. Airo Shot Blasting machine manufacturer specializes in Manufacturing sandblasting machine of & Shot Blasting machines. Shot Blasting machines are customized and slandered type portable shot blasting Equipments which are used to clean the surface. Sand Blasting Machine is leading Manufacturers of Portable Sand Blasting Machine with various type blasting equipment like Blast Hopper,Blast Rooms, Blast Cabinet etc. Airo Shot blasting manufactures a wide range of shot blasting machines/sandblasting machines for various applications to meet the requirements of different sectors.

    See More:-

    Grit Blasting Machine
    Sand Blasting Cabinet
    Thermal Spray Gun
    Sand blasting Hopper

    ReplyDelete


  80. Such an amazing article thanks for sharing this


    Shot Blasting Machine Manufacturer in India. Shot blasting machine also provides shot blasting cabinet, portable shot blasting machine.Our organization is known to be one of the trustworthy Supplier, Manufacturers, and Exporters of the Sandblasting machine, Thermal Spray Guns, and Abrasive Blasting Media. For more Information contact us @+918003997469

    See More:-
    Sandblasting Cabinet
    Portable shot blasting machine
    Portable sandblasting machine

    ReplyDelete
  81. HashtagPP is your one-stop destination for Video shooting, editing and production. We do it all!

    https://hashtagpp.com

    ReplyDelete
  82. This post is probably where I got the most useful information for my research
    Cheap Assignment

    ReplyDelete
  83. Thank You Author for providing such an Insightful article about Digital Marketing. If Someone out there is looking for flipkart product listing services can connect with ITDigiTech Solutions which is the leading Amazon Product Listing Services. Visit us for more info.

    ReplyDelete
  84. Grit Blasting Machine is a technique which smoot a surface with the help of high-velocity steel abrasive material. The grit blasting machine method helps in obtaining the cleaning and preparation of the surfaces for the secondary finishing operations. The selection process of the type of grit blasting equipment and machines depends on the size and shape of the equipment. The surface to be cleaned, the required final surface finish specification, and the overall required process.

    We are grit blasting Machine Manufacturer in India, Supplier & Exporter of, grit blasting cabinet, room, hopper in India at a low price for sale.
    See More:
    Grit Blasting Machine Price in India
    Grit Blasting Machine Manufacturers

    ReplyDelete
  85. Sand blasting Cabinets are one of the top manufacturers of abrasive Sand Blasting Cabinet Manufacturer in India such as Pressure Blasting Cabinet (PB) and Suction Blasting Cabinet(SB) from India. The superior quality blasting cabinet machines are widely applied for varied uses in the construction, agricultural and other industrial applications for surface cleaning of concrete and metal surfaces efficiently.
    See More:
    Sand Blasting Cabinets
    Sand Blasting Cabinet price in India
    Sand Blasting Cabinet Manufacturers

    ReplyDelete
  86. Customs performance is rated at 3.1. It indicates a satisfactory performance - the customs clearance procedure is effective in general, although long time can occasionally be a problem; the customs system certainly does not discourage international business activity; documents and fees needed are usually publicly available.

    Infrastructure quality in Israel is rated to be at 3.11. It indicates a satisfactory quality - roads, railroad, ports and other facilities are able to handle significant traffic at all times and are also suited to various types of transport vehicles and vessels.

    International shipment quality is 2.71. It indicates a satisfactory performance - the services are adequate and the prices are not too high and usually accurately match the quality, although there is still room for improvement. http://www.confiduss.com/en/jurisdictions/israel/infrastructure/

    ReplyDelete
  87. The European countries, with a long history of trade, a free market system, and a high level of development in the previous century are generally in the north and west of the continent. They tend to be wealthier and more stable than countries congregated in Europe's south and east, even though the gap is closing, especially in Central and Eastern Europe, partly due to higher growth rates, but partly also due to the equalizing effect provided by the European Union. http://www.immigration-residency.eu/counsel/europe/

    ReplyDelete
  88. Great post. Keep sharing amazing content like this

    Also checkout some interesting content from below links

    Google adsense approval
    Keyword Research for seo
    thrivecart review

    ReplyDelete
  89. Really it was so amazing article. I like your content. Thanks for sharing your information.
    Golden Triangle India Tour

    ReplyDelete
  90. Very nice post and right to the point. also, see other posts really good content I find here. Thank you. Golden Triangle India Tour

    ReplyDelete
  91. Google offers advertisements which appear in search results on google.com with the use of Google AdWords or advertisements that
    appear on other websites through the Display Network and Google’s AdSense program.
    With google ads you can appear in the top for searched keywords.Thus you will receive more relevant customers for your business.
    Google Ads Services
    You can get Apple-certified repairs and service at the Apple Store or with one of our Apple Authorized Service Providers.
    mobile phone repair in North Olmsted

    ReplyDelete
  92. Wow Nice Blog:

    Living in Canada is really a awesome memory. We can enjoy most of the things. I love it. But, the only problem comes with it is Canada immigration process.
    If you're worried about immigration process, click here to try this consultants for quicker and high success rate Canadian visa.
    Check : Best Immigration Consultants in Delhi for Canada

    ReplyDelete
  93. Yahoo mail recovery an account recovery option to the users who have forgotten their password so that they can reset a new password for their account or recover to
    Yahoo-email-recovery. Yahoo e mail recovery is possible with the help of few account recovery options such as recovery phone number and recovery email and then call for yahoo-customer-service-number-usa
    change yahoo mail password

    ReplyDelete
  94. Great Content & Thanks For Sharing With oflox. Do You Want To Know How To Earn Money From Helo App

    ReplyDelete
  95. Thank you for sharing, I am very happy to know your blog. Here are some blogs I would like to send you. Please don't delete the link, hi
    mo da dep
    game nổ hũ đổi thưởng uy tín
    bắn cá đổi thưởng 2021
    làm cavet xe

    ReplyDelete
  96. Hello everyone I want to introduce you guys to a group a private investigators who can help you with information you need in any situation in life and they are ready to follow you step by step until your case is cleared just contact +17078685071 and you will happily ever after

    ReplyDelete
  97. will smith net worth

    Willard Carroll Smith Jr. is an American actor, producer and rapper. In April 2007, Newsweek called him & quot;the most powerful actor in Hollywood

    ReplyDelete
  98. Great information...Your post the very informative i have learned some information about your blog thank you for Sharing the great information.....
    Domestic Lifts Manufacturers in Ghaziabad
    Domestic Lifts Manufacturers in Delhi NCR

    ReplyDelete
  99. Thanks for Sharing such an great information keep it up Digifixers

    ReplyDelete
  100. Like it.
    https://www.surat-training-course.com/web-designing-training-course-surat

    ReplyDelete

  101. Thanks for the interesting content. I like your post and your blog is amazing.
    If you are interested in Video Downloader apps you can check my blog site. It is new and really informative.

    VidMate Download 2018

    ReplyDelete
  102. As a Website Development Company, we gratify to our clients with a complete range of development services like Static Website, Dynamic Website, E-commerce Portal, MLM Portals, and Mobile Applications.

    ReplyDelete
  103. Web Designing and Digital Marketing Company plays a vital role in most industries, right from managing the resources in manufacturing plant to gathering customer reviews in service sector to understand the market better.

    ReplyDelete
  104. Great with detailed information. It is really very helpful for us.
    Village Talkies a top-quality professional corporate video production company in Bangalore and also best explainer video company in Bangalore & animation video makers in Bangalore, Chennai, India & Maryland, Baltimore, USA provides Corporate & Brand films, Promotional, Marketing videos & Training videos, Product demo videos, Employee videos, Product video explainers, eLearning videos, 2d Animation, 3d Animation, Motion Graphics, Whiteboard Explainer videos Client Testimonial Videos, Video Presentation and more for all start-ups, industries, and corporate companies. From scripting to corporate video production services, explainer & 3d, 2d animation video production , our solutions are customized to your budget, timeline, and to meet the company goals and objectives.
    As a best video production company in Bangalore, we produce quality and creative videos to our clients.

    ReplyDelete
  105. You can get all the online latest Faridabad news and updates on only Faridabad Jyoti News channel. Read all breaking news including sports, national, crime, Delhi NCR, politics news and business news headlines online on Faridabad Jyoti News channel.

    https://www.faridabadjyoti.com/

    ReplyDelete
  106. A great post. Thank you for sharing.

    Please visit for latest Cloud based quality management software Compliancequest

    ReplyDelete
  107. They can guide you to remarkable places and you will have every chance to take advantage of their sexual advantage. They expect the man to be naturally horny and there is nothing to hide from her. They can be gentlemen and surprise her, but she is always ready to take action anywhere.

    Agra Escorts Service |
    Escorts In Mainpuri |
    Escorts In Mathura |
    Escorts In Meerut |
    Escorts In Mirzapur |
    Escorts In Moradabad |
    Escorts In Muzaffarnagar |
    Escorts In Noida |

    ReplyDelete
  108. Usurp the top position on search engines after availing of our Website Development Services Delhi. Webgross offers website development coming from efficient coders who incline towards user intent and satisfaction. Trust us as we prove ourselves to you through sheer hard work and determination, with availability at your service Content writing services Delhi.

    ReplyDelete
  109. Thank you for this wonderful information looking forward for more Website Designing Company in Delhi

    ReplyDelete
  110. Great job for publishing such a nice article. Your article isn’t only useful but it is additionally really informative. Thank you because you have been willing to share information with us python course in delhi

    ReplyDelete
  111. The tour package for the best backwater resorts in Kerala is very much affordable, makes every visitor to count on another trip to the best resorts in Kerala.

    ReplyDelete
  112. Excellent information Providing by your Article, Please post some more related topics. I like this post very much.
    SUPER KAMAGRA IN DUBAI 100mg

    ReplyDelete
  113. Posted blog really impressed me lot here I found tips and new ideas for SEO Content Writing Services India which gave helpful reasons, keep posting new informative blogs with us after all I am your regular blog reader Content writing services Delhi.

    ReplyDelete
  114. Hello, I am Arpita Sinha from Delhi
    I have Read your post and found it interesting...

    Thanks for sharing
    Have a Great Day

    Graphic design course in Delhi

    ReplyDelete
  115. Hello Everyone These are Some Of My Website That I Will Rank In Google Search and Make Some
    Money Online From Google AdSense So You Can Also Check These Website.
    vidmate download
    blog
    GBWhatsapp
    free fire name
    YouTube Thumbnail Downloader
    Tamilrockers
    JPG to PDF
    Hope I Will Rank it in Google as Fast as Possible. Thanks.

    ReplyDelete
  116. It's an impressive blog post where I have found influenced knowledge which helped me lot in my passion check for more information Blog sites thanks for providing blog post with us.

    ReplyDelete
  117. Lab Grown Diamonds on the internet at the lowest prices when compared with the other Man Made Diamonds Sellers. Unique Collection, Best Quality Guaranteed!

    ReplyDelete
  118. Thanks for sharing amazing information keep posting!
    mangaowl

    ReplyDelete

  119. Get the best deals on Huawei Switches and find everything you'll need to improve your home office setup at Cloud Infotech.

    ReplyDelete
  120. Great! Thanks for sharing this kind of information it’s really very nice and useful for me.
    icici eazypay This app allows for free mobile transactions and proves to be beneficial for all retailers, dealers and professionals as this app helps them to receive instant cash payments to their customers by selecting any options available in most digital modes.
    JBL Car Speakers Amazon proudly maintain one of the largest JBL – Car Speakers available. JBL has a speaker that fits almost all types of vehicles and budget. Obviously there is no place near our cheapest type of car speakers, Chinese New Year 2022Chinese New Year Celebrations Also called The Festival of Spring, in China begin with the 23rd day of twelve lunar months of the Chinese calendar. The celebration lasts approximately 23 days, and it ends at the end of first lunar month following the year according to the Chinese calendar.

    ReplyDelete
  121. I like this post. I needed a post like this and I’m impressed Thank you for sharing this.

    https://jeetechacademy.com/web-development-course/

    ReplyDelete
  122. Best Digital Marketing Serices-Best SEO Optimization Services Provide We are provide SEO Optimization Services to Client Website Increase costumer to give Best Facility https://thebravemedia.com .

    ReplyDelete
  123. Escape the daily grind and relax your mind, body and soul at Whether you're a dedicated worker or an overworked student, our expert massage therapists are here to relieve tension in tense muscles with their b2b spa massage in bangalore ultimate skill set of skills!

    ReplyDelete
  124. The staff with Body to Body Massage in hyderabad offer all modern amenities at our center to help you relax and at ease. The atmosphere is awe-inspiring due to the pleasant scent of incense and the peacefulnes b2b spa massage in hyderabads that you'll experience at our center located in hyderabad.

    ReplyDelete
  125. Safe and secure massage spa Bangalore, for female also therapies are there Indian Ayurveda massage to reduce stress. Thai massages for full body stretching. Book Now Visit b2b massage in bangalore

    ReplyDelete