Sunday, July 4, 2010

Reversing an RF Clicker

by Travis Goodspeed <travis at radiantmachines.com>
concerning the Turning Point ResponseCard RF,
having FCC ID R4WRCRF01,
patented as USA 7,330,716.


Turning Point Clicker

In this article, I describe in detail the methods by which I have reverse engineered the TurningPoint ResponseCard RF, casually known among students as a "Clicker". This 2.4GHz radio transceiver is used in undergraduate university classrooms for automated roll-call and in-class quizzing or voting. By dumping and analyzing its firmware, one can determine the radio protocol necessary to intercept and forge packets, as well as to build a custom base station. The radio hardware that I have used is a reprogrammed Next HOPE Badge running the GoodFET firmware.

A follow-up article will likely describe the writing of replacement firmware, but that can be easily enough discovered by an enterprising reader. My purpose instead is to provide the information necessary to build compatible products, as well as to teach the technique of reverse engineering these products to find such information when none is available.

Disassembly


The Clicker's keypad is attached only with adhesive, and it can be pulled off after lifting an edge with a knife blade. Beneath the keypad, there are four screws holding the board in place, plus a fifth from the rear of the device. If you are lucky, these will be small Phillips screws, but the unlucky will find tri-wing "Nintendo" screws. I was lucky to have one of each type, but those with neither a Phillips-screwed Clicker nor a tri-wing screwdriver can buy one or try one of these tricks.
Devil Screws

In either case, it isn't strictly necessary to open your clicker, as test-points for dumping and replacing its firmware are accessible from the battery compartment. Further, the radio communications are accessible with no hardware access whatsoever.

Hardware


The Clicker is built upon a Nordic nRF24E1 chip, which combines an 8051 microcontroller with an nRF2401 radio transceiver. Although the two cores have been combined into a single package, the 8051 core speaks to the radio through a few bit-field registers and an internal SPI bus, which is shared with the external SPI bus.

As the nRF24E1 lacks internal non-volatile storage, a CAT25C32 (pdf) SPI EEPROM is used for program and configuration storage. Within the microcontroller, there is a masked ROM bootloader from 8000h to 81FFh that loads executable code from the EEPROM into executable RAM from 0000h to 0FFFh.

Hacked Clicker Board

Dumping Firmware


At the base of the circuit board's primary side, there are test points for the SPI EEPROM. As the default firmware only uses the SPI bus when buttons are pressed, this EEPROM may be dumped at any point after the device has booted. The test points are as follows, which should be matched to those of equivalent names in the GoodFET SPI Table. They were determined by use of a continuity tester.
T4MISO
T5SCK
T6MOSI
T3!CS
T1VCC
GNDGND


In order to dump the firmware, I quickly wrote a GoodFET client for the 25C32 using its datasheet. A read is performed by sending {0x02, AL, AH, 0} as a SPI transaction, with the result coming back as the fourth byte. Doing it this way with the GoodFET's SPI driver is slower than having C code within the GoodFET dump the whole ROM, but it's fast enough for a dump and takes very little code.
Quick and Dirty 25C32 Driver

From this point, I dumped the firmware with 'goodfet.spi25c dump image.hex', converted the Intel Hex file to binary, and popped it open in Emacs/hexl. The result looks something like the following, whose format is described in the nRF24E1 datasheet. The opening passage is {u8 config, u8 entry offset, u8 blockcount}. Here {0x0B, 0x07, 0x0B} means that executable code begins at byte 0x07, and that the total image length is 0x0B*256==2,816 bytes. (Additional space within the SPI ROM is unused and left as 0xFF.)
Clicker ROM

To produce an image suitable for a disassembler, I cut the bytes before 0x07 to make an image beginning with {0x02, 0x0A, 0xB7, ...}. The extra bytes in this region are the serial number and default frequency, but we'll get back to that later.
Clicker Dev Kit

Firmware Analysis


As the firmware is only three kilobytes, it doesn't take terribly long to reverse engineer. First, the Special Function Registers (SFR) which are defined on pages 79 and 81 of the nRF24E1 datasheet are fed to the disassembler.

(I'm using IDA Pro here, but any 8051 disassembler with a decent text editor could suffice. All of the following function labels are from my imagination, while Special Function Registers (SFRs) come from the nRF24E1 datasheet.)

For example, "MOV 0xA0, #0x80" is rather opaque, but "MOV RADIO, #0x80" makes it clear that the immediate value 0x80 is being placed into the RADIO register. Page 89 of the datasheet will then explain that the high bit of the radio register is power control, so this instruction is powering up the radio for use. Similarly, "SETB RADIO.3" is setting the fourth bit of the RADIO register, which the datasheet describes as raising the CS signal.

Once the SFR addresses are known, it becomes useful to search for them in order to identify the I/O routines. In the nRF24E1, the radio is accessed across a SPI bus, so a good first step is to identify the SPI routine. The function containing this code will always include a MOV involving the SPI_DATA register.
SPIRXTX for 8051

Having this, a list of cross-references quickly shows that while few functions call the SPIRXTX function, each calls it many times. This is because the author has chosen to repeatedly call that function with immediate values, rather than to dump an array of bytes with a for(){} loop.
Functions calling SPITXRX

While the disassembler can automatically identify the function entry points in the table above, it is not capable of giving them English names or descriptions. To understand how this is done, it is necessary to read the datasheets of the SPI devices.

The SPI EEPROM chip, a CAT25C32, is used by dropping the !CS line then writing an opcode byte followed by its parameters or results. Opcodes include WREN/WRDI for write protection, RDSR/WRSR for accessing a status register, and READ/WRITE for reading and writing bytes. A WRITE may only be performed when the external !WP pin is low and the software write protect has been disabled by opcode. A transaction begins when !CS drops low and ends when it drops high.

To identify the function which reads a byte from the 25C32, a few things can be safely assumed: (1) The function will begin by dropping some I/O pin (!CS). (2) The function will then broadcast the READ opcode, 0x03. (3) It will then broadcast a sixteen bit parameter; that is, DPL followed by DPH. (4) Finally, it will return the result of a fourth SPIRXTX call. In pseudocode, that would be something like
SPIROMPEEK(u16 ADR){
SPIRXTX(0x03);
SPIRXTX(ADRL);
SPIRXTX(ADRH);
return SPIRXTX();
}


Sure enough, one of the few functions calling SPIRXTX does exactly this. The constant pushing and popping of the parameters is a quirk of the compiler, which might possibly allow it to be identified. From the code below, it is clear that P0.0 is the !CS line of the CAT25C32.
SPIROMPEEK

The SPIROMPOKE function looks similar, except that two transactions are performed. First the WREN (0x06) opcode is sent to enable writing, then WRITE (0x02) is used to perform the actual write.

The other SPI operations concern the nRF2401 radio core, which behaves differently from the EEPROM. Rather than transactions being an opcode followed by parameters, there is only a single SPI register that must be completely written during a transaction. A second register, selected by the CE line, contains the packets.

The configuration is set by one big register, sent MSBit first. If fewer than the needed bytes are sent, the value is right-aligned into the lower bytes of the register. That is, the last byte sent is always (CHAN<<1)|RXMODE and the second to last always describes the radio configuration.
nRF2401 Config Register

Searching around a bit yields the RADIOWRCONFIG function, the tail of which is below. It can be seen from the code that the 0x1A IRAM byte holds the channel number. That is, if 0x20 is stored at 0x1A, the radio will be configured to 2,432 MHz. The other configuration bytes reveal that the MAC addresses are 24 bits, the checksum is 16 bits, and the device broadcasts at maximum power sourced from a 16MHz crystal. (That the configured crystal is identical to the one on the board is very important. Some enterprising coders will lie to a chip about its crystal in order to access an unsupported radio frequency.)
Clicker RF Config

At this point, it still remains to sniff traffic is to find the target address to which packets are broadcast as well as the frequency. We'll start with the address, because that's a bit easier.

The TXPACKET function involves a lot of PUSH and POP instructions, but it otherwise looks very similar to the RADIOWRCONFIG function, in that a series of bytes are written in order with repeated function calls to SPIRXTX. In pseudocode, this function becomes the following. From the radio documentation and configuration, it is clear that the first three bytes will be the target MAC address. From the RADIOWRCONFIG() function, it is equally clear that the three bytes at 0x1B are the receiving MAC address of the unit. (The parameter of the function happens to be the button press, as can be determined by tracking the keyboard I/O routines or viewing a few packets.)
void TXPACKET(u8 button){
RADIOHOP(); //set channel

//Target MAC address
SPIRXTX(&0x1E);
SPIRXTX(&0x1F);
SPIRXTX(&0x20);

//Source MAC address
SPIRXTX(&0x1B);
SPIRXTX(&0x1C);
SPIRXTX(&0x1D);

//Data value
SPIRXTX(button);
}

The radio itself will append a 16-bit CRC; therefore, the full packet then becomes {u24 tmac, u24 smac, u8 button}.

To determine the value of the target MAC address, just grep the disassembly for "mov" and one of 0x1E, 0x1F, 0x20. The relevant instructions are as follows, setting the target MAC address to 0x123456. (In 8051 notation, the first instruction moves the immediate constant #0x12 into byte 0x1E of IRAM.)
mov 0x1E, #0x12
mov 0x1F, #0x34
mov 0x20, #0x56


As this point, it would be possible to scan each channel for a few seconds, listening for packets sent to that address, but it's classier to find the value by static analysis. Acting on the hunch that the configuration is held in EEPROM and looking for references to the SPIROMPEEK() function, the READIDFREQ() function can be found. As can be seen in the fragment below, EEPROM[6] holds the channel number while the MAC address is at EEPROM[3,4,5].
Clicker Config

As the EEPROM begins with "0b 07 0b 15 79 1b 29", it's clear that the MAC address of the unit from which it came is 0x15791B and that it is broadcasting on 2400+0x29=2441MHz. This can be double-checked by the serial number "15791B" being printed on the label.

Implementation


Knowing the modulation scheme, target address, and packet contents, it becomes possible to sniff traffic from a Clicker. This is performed by use of the GoodFET firmware on a Next Hope badge, my prior tutorial for which describes the process of packet sniffing.

The NHBadge board contains an nRF24L01+ radio, which differs dramatically from the nRF2401 in terms of how it is configured. Still, the radios are sufficiently compatible. The following hack of the goodfet.nrf client allows packets to be sniffed from the air with proper checksumming.
Sniffing TurningPoint Traffic

Sure enough, here are some packets of the 5 button being pressed on unit 1F8760. The keypress is the final byte in ASCII.
Clicker Sniffing

Response Codes



Now that it is clear how to receive and recognize button presses, it becomes necessary to reverse engineer the response codes which might be sent from the access point. Without hearing a reply of at least an ACK, the Clicker will continue to broadcast each message more than three hundred times. This takes more than ten seconds, during which all other key presses are ignored.

The broadcast loop within the MAIN() function would look a little like this in C.
for(count=0;count< MAXCOUNT && !reply;count++){
TXPACKET(button);
reply=RADIORX();
}
switch(reply){...}


This region is easy enough to find, but there's another command mode. An easier target is the channel hopping routine, which constantly broadcasts 0x3F while incrementing the channel, sticking with the last one on which a reply of 0x18 was received. Channels 1 through 83 are attempted; that is, 2,401 MHz to 2,483MHz at 1MHz steps.
Clicker SYN/ACK

Checking this code within the MAIN() function reveals that its effect is to blink the green LED (P1.1) six times, exiting the broadcast loop. Other commands include 0x04 (LED Off), 0x06 (LED Green), 0x15 (LED Red), 0x11 (Blink Green), 0x14 (Blink Red), and 0x18 (Blink Green, Channel Lock). All undefined opcodes set the red LED.

Conclusions


By sniffing traffic within a classroom, it is possible to watch votes as they are being cast by students. Similarly, packets could be broadcast by a reprogrammed Clicker or NHBadge to make a student in virtual attendance, automatically voting with the majority so as to gain perfect attendance and a solid C quiz average. Where instant feedback is available, this might even allow for a solid A quiz average. Without taking advantage of the masked-ROM option of the nRF24E1, the code cannot be even slightly protected from extraction and reverse engineering.

Less adventurous users can jam the network by running 'goodfet.nrf carrier 2441000000' to hold a carrier wave on the channel. The only attempt at a frequency change is made when pressing the GO button, at which point the new channel can be discovered and similarly jammed.

Since performing this work, it has come to my attention that a USRP plugin for doing this to the competing 900MHz iClicker product is available as http://gr-clicker.sourceforge.net/. Additionally, the infrared Clicker units were broken with a little tool called Survey Says. I have ordered more sophisticated Clicker models from CPS and Turning Point, and proper descriptions of them will soon follow.

135 comments:

Akiba said...

If the EEPROM bus is shared with the SPI bus, it might also be possible to sniff the traffic to the radio. I'll be getting some ATMega128RFA1 chips soon so I'll be looking into this on that chip as well.

Anonymous said...
This comment has been removed by a blog administrator.
Tixlegeek said...

Hi

Very nice work.
I think i gonna often come back.

++

Gonzalez Family said...
This comment has been removed by the author.
Dorkfish said...

Awesome job! I was actually wondering how difficult this would be while i was in math class last week. It's past my skill level, but hopefully I can work on this in the future. My class uses the "iClicker" which operates at 915MHz, but it's a similar concept I suppose. Thanks again for the great write up!

Travis Goodspeed said...

Akiba,

You're right that the transactions might be leaked over the SPI bus, with the exception of the Slave Select line that would be internal-only.

Let me know what you find with the ATMega.

--Travis

Anonymous said...
This comment has been removed by a blog administrator.
Jeff Vyduna said...

You want a job? Wanna do this and learn some ruby on the side?

You rock.

-The guys from Poll Everywhere
http://www.polleverywhere.com

(We're the other guys tearing up clickers for fun)

Anonymous said...
This comment has been removed by a blog administrator.
Anonymous said...
This comment has been removed by a blog administrator.
Anonymous said...
This comment has been removed by a blog administrator.
Anonymous said...
This comment has been removed by a blog administrator.
Anonymous said...
This comment has been removed by a blog administrator.
Anonymous said...
This comment has been removed by a blog administrator.
Anonymous said...
This comment has been removed by a blog administrator.
Anonymous said...
This comment has been removed by a blog administrator.
longcall911 said...

Has TurningPoint suggested that they would improve security on these devices or will they simply pretend it is not a problem?

BTW: great work...

黃於志豪士賢 said...
This comment has been removed by a blog administrator.
珍盈洪 said...
This comment has been removed by a blog administrator.
文王廷 said...
This comment has been removed by a blog administrator.
Anonymous said...
This comment has been removed by a blog administrator.
Anonymous said...
This comment has been removed by a blog administrator.
于庭吳 said...
This comment has been removed by a blog administrator.
Anonymous said...
This comment has been removed by a blog administrator.
Anonymous said...
This comment has been removed by a blog administrator.
Anonymous said...
This comment has been removed by a blog administrator.
Anonymous said...
This comment has been removed by a blog administrator.
Anonymous said...
This comment has been removed by a blog administrator.
Me said...

What GoodFET controller do you use to interface with the SPI?

Travis Goodspeed said...

Howdy Me,

Any GoodFET model will do, even the old MSP430F1612 devices (GoodFET11) or the NHB12 itself.

--Travis

Kevin said...

Hi Travis, I was wondering if you have attempted any more hacks with the newer models of the turning point clickers?

Thanks from a fellow hacker,
-Kevin

Unknown said...

Always voting with the majority would probably get you an A. The majority gets each question right, but the individuals making up that majority changes each question such that the individuals average a C or whatever.

Unknown said...

Always voting with the majority would probably get you an A. The majority gets each question right, but the individuals making up that majority changes each question such that the individuals average a C or whatever.

Alvin Smith said...

Excellent post. I want to thank you for this informative read. Keep up your great work. PCB Fabrication

Softql said...

Travel goods blog RF Post processing

sachin rana said...

hello sir ,can you tell me about the receiver how can i make receiver for multiple transmitter

Deba Sheesh said...

Great post, you have pointed out some excellent points, I as well believe this is a very superb website.
Plastic Flow Meter

Ogen Infosystem said...

Nice Blog, Visit for the best SEO Service and Website Designing and Development for your business.
SEO Service in Delhi

Mutual Fundwala said...

For the best Mutual fund Investment and for the best Mutual fund Schemes Visit Mutualfundwala.
Mutual Fund Agent
Mutual Funds India

Y and H Cargo India said...

Nice Blog, Visit for Freight Forwarding and Shipping Services.
Logistics Company in India
Freight Forwarders in Delhi

Spin Gurus said...

For best sound and audio engineering course visit our website spingurus.
audio engineering courses

Mobile app development company in Gurgaon said...

Mobile app development company in toronto

TeknikoGlobal said...

Thanks, you guys that is a great explanation. keep up the good work in your granite blog.
App Development Company in Noida

Fitness Bite said...

https://www.smore.com/u/roseeliza

https://www.smore.com/7vrn0-prows-plus-hair-growth

https://www.smore.com/gy1xv-keto-burn-xtreme-trial

https://www.smore.com/ku8x3-keto-bliss-diet-review-ketobliss

https://www.smore.com/as0k6-keytoned-advance-keto

https://www.smore.com/0pqtj-grn-keto-diet-pills

Laurine said...

La veilleuse coranique bluetooth avec sa télécommande pour offrir.
Cadeau ramadam idéal
La veilleuse coranique personnalisée pas cher
Veilleuse coranique personnalisée
Veilleuse coranique personnalisée

Chiến SEOCAM said...

Phối chó bull pháp

Phối giống chó Corgi

Phối chó Pug

Phối giống cho Pug

Designer said...

Thank you very good article! You may be interested in products: sapphire stone (đá sapphire), emerald stone (đá emerald), ruby ​​red stone (đá ruby đỏ)

gunmetal jeans said...

It’s in reality a great and useful piece of information. I am happy that you simply shared this helpful info with us. Please keep us informed like this. Thank you for sharing.

Structural Analysis in UK
Structural Analysis in India

Chiến SEOCAM said...

Thu mua chó corgi

Thu mua chó Bull pháp

Thu mua chó pug

Thu mua chó poodle

Designer said...

Thank you very good article! You may be interested in products: teach math for 4-year-old children( dạy toán cho trẻ 4 tuổi),developing mathematical thinking for children( phát triển tư duy toán học cho trẻ)

Đồ gia dụng said...

Bài viết bạn rất hay:



Chúng tôi là đơn vị cung cấp các sản phẩm chất lượng như:



lều xông hơi



lều xông hơi sau sinh



lều xông hơi giá bao nhiêu


Đồ gia dụng said...

Bài viết bạn rất hay:



Chúng tôi là đơn vị cung cấp các sản phẩm chất lượng như:



Giảo cổ lam



giảo cổ lam giải độc gan



giảo cổ lam giảm béo

Hoang Phan said...

Bài viết rất hay: Chúng tôi có các cơ sở in ấn tại các điểm sau :



công ty in bao bì tại hưng yên



báo giá in thùng carton giá rẻ nhất



in bao bì tại hà nội


Đồ gia dụng said...

Bài viết rất hay: Chúng tôi chuyên cung cấp các sản phẩm chất lượng sau:



bồn massage



bon ngam chan



máy massage chân



Cảm ơn các bạn!

Đồ gia dụng said...

Bài viết bạn rất hay:



Chúng tôi là đơn vị cung cấp các sản phẩm chất lượng như:



lều xông hơi



lều xông hơi sau sinh



lều xông hơi giá bao nhiêu




Đồ gia dụng said...

Bài viết bạn rất hay:



Chúng tôi là đơn vị cung cấp các sản phẩm chất lượng như:



Giảo cổ lam



giảo cổ lam giải độc gan



giảo cổ lam giảm béo

Đồ gia dụng said...

quần áo bảo hộ lao động
Xưởng may bảo hộ lao động
Đồng phục phòng sạch

Dale Morris said...

Norton toll free number
McAfee technical support phone number
Phone number for Malwarebytes
Hp printer support windows 10
Canon printer tech support telephone number

Service Center iPhone said...

Learning Indonesian
Indonesian Courses
Indonesian Courses
Lembaga Kursus Terbaik Indonesia
Service Center HP Indonesian
Lembaga Kursus Terbaik Indonesia
Makalah Usaha Bisnisilmu konten

phannhathoang144@gmail.com said...

Bài viết rất hay: Chúng tôi có các dịch vụ in ấn chuyên nghiệp sau:



in bao bì vỏ hộp

in hộp bìa cứng

Service Center Acer said...

Panasonic
Samsung
Huawei
Service iPhone Lampung
iPhone
Vivo
Oppo
Xiaomi
Service HP Bandar Lampung

Best Course Indonesia said...

Best Course Indonesia
Easy Indonesian CoursesLearning Indonesia
Indonesia Courses
Indonesia Courses
www.lampungservice.com
Service HP
lampungservice.com
Makalah Bisnisilmu konten

Đồ gia dụng said...

bản lề tủ bếp
phụ kiện tủ bếp giá rẻ
thùng rác âm tủ bếp

Designer said...


Vanskeligheter( van bi ) vil passere. På samme måte som( van điện từ ) regnet utenfor( van an toàn ) vinduet, hvor nostalgisk( van bướm ) er det som til slutt vil fjerne himmelen.

Service Center Lenovo said...

https://jskursus.blogspot.com
https://jasaeditfotobandarlampung.blogspot.com
http://lampungservice.com
https://tempatservicehpdibandarlampung.blogspot.com
https://jalanbumisarinatar.blogspot.com
https://kursusservicehplampung.blogspot.com
https://makalahbiz.blogspot.com
https://ilmukonten.blogspot.com
http://lampungandroid.blogspot.com

lampungservice.com said...

Indonesia
Easy
Learning
Indonesian
lampung
www.lampungservice.com
oppo

jeewangarg said...

Web Designing and Web Development are two different fields and “JeewanGarg” the Website Designing Company in Delhi has both procedures under one roof. You have no need to look any further because we have a complete team of professionals including persons who experts in Photoshop, Illustrator, and relevant designing tools used today.

Shotblasting said...

Very nice post and right to the point. also, see other posts really good content I find here. Thank you.
shot blasting machine
shot blasting
sand blasting
sand blasting machine
steel shots distributors
Sandblasting Abrasive media

Video Production Company said...

Excellent and nice post. It will beneficial for everyone. Thanks for sharing such a wonderful post.
video production company
film production house
Corporate film makers
Documentary Film Makers in Delhi
Filmmakers in Delhi
promotional video services in delhi ncr

Muhammad said...

For Best private ambulance call at Almas ambulance service in Delhi. We help patients to get best medical care on right time by our ambulance service.
http://www.almasambulance.com
International air ambulance
Air ambulance Kolkata
Air ambulance guwahati
Air ambulance patna
Air ambulance ranchi
Air ambulance srinagar
Air ambulance Delhi

lampungservice.com said...

https://storeindonesian.blogspot.com/ Indonesia
youtube.com
Indonesian
Service HP
Best Online Store Indonesia
Komponen
Kursus
Jual Beli

Pankaj Singh said...

Nice blog, Get you website designing responsive and creative and also digital marketing services at ogen info system Delhi, India.
Dynamic Website Designing Company in Delhi

sachin sinhmar said...

Rice Bags Manufacturers
Pouch Manufacturers
wall putty bag manufacturers
Lyrics with music

sachin sinhmar said...

we have provide the best ppc service.
ppc company in gurgaon
website designing company in Gurgaon
PPC company in Noida
seo company in gurgaon
PPC company in Mumbai
PPC company in Chandigarh

sachin sinhmar said...

we have provide the best fridge repair service.
fridge repair in faridabad
Videocon Fridge Repair in Faridabad
Whirlpool Fridge Repair in Faridabad
Hitachi Fridge Repair In Faridabad
Washing Machine Repair in Noida
godrej washing machine repair in noida
whirlpool Washing Machine Repair in Noida
IFB washing Machine Repair in Noida
LG Washing Machine Repair in Noida

sachin sinhmar said...

Bali Honeymoon Packages From Delhi
Bali Honeymoon Packages From Chennai
Hong Kong Packages From Delhi
Europe Packages from Delhi
Bali Honeymoon Packages From Bangalore
Bali Honeymoon Packages From Mumbai
Maldives Honeymoon Packages From Bangalore
travel company in Delhi

sachin sinhmar said...

gmp certification in delhi
halal certification in delhi
halal certification services in delhi
iso 13485 certification in delhi
website designing services
seo serivces in delhi

Entertaining Game Channel said...

This is Very very nice article. Everyone should read. Thanks for sharing. Don't miss WORLD'S BEST TrainDrivingSimulatorFreeGames

Kelly Angles said...

Agar aap apne husband se pareshan hai or uss se door rhana cahati hai toh aap Talaq lene ki dua ko kijiye aap pati aapko khud ba khud talaq de dega

Entertaining Game Channel said...

This is Very very nice article. Everyone should read. Thanks for sharing and I found it very helpful. Don't miss WORLD'S BEST CarGames

Islamic dua helpline said...

Get your lost love in 3 days
Dua to get loved one back

Service Center Blackberry said...

iphoneiphone vivoaxiooiphonebimbelbateraiServiceyoutubeService

Mutual Fundwala said...

Awesome Blog, Get the best Investment Advice and information about the Best Mutual Funds Company in india.
Mutual Fund Distributor

suachuadogotainha said...

cửa lưới dạng xếp
cửa lưới chống muỗi
cửa lưới tự cuốn
lưới chống côn trùng

airoshotblast said...

thanks for sharing a informative blog. @http://www.airoshotblast.net/

Mobile app development company in Mumbai said...

Mobile app development company in mumbai

Unknown said...

PPC Service in Delhi
PPC Companies in Delhi
SEO Company in Delhi
SEO Company in Delhi NCR
SMO Company in Delhi
SMO Company in India

jacklinemelda said...

Our best custom essay writing service are reputable and known for offering high quality custom term papers. We normally write academic papers in all disciplines of study.

lajwantidevi said...

This is a nice Site to watch out for and we provided information on
vidmate make sure you can check it out and keep on visiting our Site.

shilpi said...

Vidmate is one of the best known applications currently available for downloading videos and songs from online services like Vimeo, Dailymotion, YouTube, Instagram, FunnyorDie, Tumblr, Soundcloud, Metacafe, and tons of other multimedia portals. With this highly recommended app, you’ll get to download from practically any video site.A free application for Windows users that allows you to download online videos.
How to download movies from internet,
Watching movie is good for time pass ,
Watch movies at home,

lajwantidevi said...

This is a nice Site to watch out for and we provided information on
vidmate make sure you can check it out and keep on visiting our Site.

Unknown said...

Web, Mobile, Cross-Platforms Solutions
Thanks For sharing an informative blog keep rocking bring more details
Google ads company

Unknown said...

Thank you for this text it’s nice and perceptive. immeasurable awe-inspiring stuff in here I hope you'd prefer to take a glance at our website regarding the tiny known secrets of checkout flows that convert like thunder. If so, here’s the link:

Best web design company in chennai
Web Development Company in Chennai

hannah said...

Are you looking for Shipping from china to usa? What is best Shipping from china to canada? do you want toShipping from china to Europe? What is fastest air freight from china to usa? how can I air freight from china to Canada?

hannah said...

click here to see cute iphone xr cases cheap. are you looking for cute protective iphone xs max cases. we have a lot of iphone x protective case. shop cute protective iphone 8 plus cases. do you want to see these jewelries. see this page to know about Best iPhone Screen Protectors. it’s better to see floral iphone 7 plus cases. do you like these girly iphone 6 case

suachuadogotainha said...

Phụ kiện tủ bếp
Phụ kiện tủ bếp cao cấp

kajal singh rajput said...

Download and install Vidmate App which is the best HD video downloader software available for Android. Get free latest HD movies, songs, and your favorite TV shows.

Music Production said...


Music Production Course In Delhi

Web Design Course In Delhi


VFX Course In Delhi

Nino Nurmadi said...

ninonurmadi.com
ninonurmadi.com
ninonurmadi.com
ninonurmadi.com
ninonurmadi.com
ninonurmadi.com
ninonurmadi.com
ninonurmadi.com

Akash said...

I really enjoyed your blog Thanks for sharing such an informative post.
https://myseokhazana.com/
Best Website Development service In Noida

Web Designer in Noida
Best Website Development service In Noida
Website Designing service In Noida
Best digital marketing service In Noida
Best digital marketing Company in Noida
Best SEO service In Noida
Best SEO Company in Noida
Software development Company in Noida
Web hosting Company in Noida
Best bulk emails Company in Noida
Best content writing Company in Noida
Best bulk sms Company in Noida
Bulk sms Company in Noida
Bulk sms service In Noida

Designer said...

PlauMai ECO
Thanh tiết kiệm xăng PlauMai ECO có tốt không
tiết kiệm nhiên liệu PlauMai ECO

Unknown said...

If your Dell printer is offline windows 10, make a call to our customer support team to get 24*7 instant support to make your experience better with dell Printer.

pioneerflimz said...

Pioneer Filmz have set a benchmark hard to match. It is the video production and film production company by far. They have expertise in production of Documentary films, corporate films and Ad films, promotional videos and all other type of creative videos. More details visit https://pioneerfilmz.com/

Designer said...

PlauMai ECO
Thanh tiết kiệm xăng PlauMai ECO có tốt không
tiết kiệm nhiên liệu PlauMai ECO

webtrehub said...

Best Graphic Designing Company in Noida
best website development company in noida

mobile app development company in noida

Best Website Designing Company in Noida

Egainz said...

Free Website Designing Course in Delhi, India
Web Design Syllabus

ZEALSOLUTION said...

Remote Monitoring and Control system
SCADA Base Remote Monitoring
best website development company in noida
Greetings! Very helpful advice within this post! It is the little changes that produce the most important changes. Thanks a lot for sharing!`

ZEALSOLUTION said...


benefits of digital marketing

unknow said...

I really enjoyed your blog Thanks for sharing such an informative post.
https://myseokhazana.com/
Best Website Development service In Noida

Web Designer in Noida
Best Website Development service In Noida
Website Designing service In Noida
Best digital marketing service In Noida
Best digital marketing Company in Noida
Best SEO service In Noida
Best SEO Company in Noida
Software development Company in Noida
Web hosting Company in Noida
Best bulk emails Company in Noida
Best content writing Company in Noida
Best bulk sms Company in Noida
Bulk sms Company in Noida
Bulk sms service In Noida

Pankaj Singh said...

Nice blog, thank you so much for your efforts. If you are looking for a creative web designer in Delhi, ogen infosystem provides one of the best and professional web designing services in delhi, India.
Top 5 Website Designing Company in India

Emily Jones said...

Amazing Article & Keep Sharing
Medixo Centre

Unknown said...

PPC Service in Delhi
PPC Companies in Delhi
SEO Company in Delhi
SEO Company in Delhi NCR
SMO Company in Delhi
SMO Company in India

Institute Coim said...

World Cup is started from 30th May 2019 to 14th July 2019. This world cup is hosted by England.
In this World cup 10 teams is participated & total 48 matches is going to played including 2 semi finals and final.
India and England are strong contenders & favourite
Cricbuzz
Online betting
Who will win
Who will win today
Cricket match prediction

Ivymelda said...

Our Custom Dissertation Writing Service is of an exceptional ideal to ensure you clinch desirable scores in your studies at minimal charges and and our prices are not deterring for anyone who seeks assistance in Custom Paper Service.

techsupport said...

vidmate
9apps

Unknown said...

Use this below

Thanks for sharing this awesome content
top 10 biography health benefits bank branches offices in Nigeria dangers of ranks in health health jobs in Nigeria recruitment opportunities Scholarship Jobs Latest Job career opportunities job vacancies recruitment career opportunities jobs online jobs by jobzilla Nigerian jobs latest news

Unknown said...

Use this below

Thanks for sharing this awesome content
top 10 biography health benefits bank branches offices in Nigeria dangers of ranks in health health jobs in Nigeria recruitment opportunities Scholarship Jobs Latest Job career opportunities job vacancies recruitment career opportunities jobs online jobs by jobzilla Nigerian jobs latest news

priya said...

Increase Height In 1 Week

Unknown said...

vidmate app
9 apps

Unknown said...

vidmate app

shilpi said...
This comment has been removed by the author.
ajay said...

vidmate app

lajwantidevi said...

vidmate app

lajwantidevi said...

vidmate app

Apk Right said...

ES File Explorer/Manager PRO Multifunctional file manager with support for all file -

Unknown said...

آیا پزشک هستید و به دنبال ترجمه تخصصی پزشکی می گردید ؟ آیا روانشناس هستید و به دنبال ترجمه تخصصی روانشناسی میگردید ؟ آیا مهندس کامپیوتر هستید و به دنبال ترجمه تخصصی کامپیوتر می گردید ؟ کار ما ترجمه تخصصی مقاله است. با خیال راحت مقاله های خود را به ما بسپارید.

Team Smartech said...

I read this blog. I am running Website Designing Company in Delhi and Website Designing Company in Faridabad . That blog will help me for promote my website.

SBCGlobalSupport said...

You can call +1-877-909-5113 and get instant solution of the SBCGlobal Query
SBCGlobal Customer care Number
SBCGlobal Customer care
SBCGlobal Customer Support Number
SBCGlobal Customer Support
SBCGlobal Customer care phone Number
SBCGlobal Customer Support phone Number
SBCGlobal Customer Service phone Number
SBCGlobal Customer service Number
SBCGlobal Customer Service
SBCGlobal phone Number
SBCGlobal Contact Phone Number
SBCGlobal Support phone Number
SBCGlobal Contact Number
SBCGlobal Support Number
SBCGlobal Helpline Number
SBCGlobal Tollfree Number
SBCGlobal Email Support Number
SBCGlobal Email Support
SBCGlobal password recovery Number
SBCGlobal password recovery
SBCGlobal Technical Support Number
SBCGlobal Tech Support Number
SBCGlobal Technical Support
SBCGlobal Tech Support

BHBUJJWALSAINI said...


Thanks you sharing information.
You can also visit on

How to think positive

Cure For Cowardice

Mudras

SOCIAL ANXIETY AND LOW SELF-ESTEEM

Online Marketing Company said...

Useful Information,Thanks for sharing.Website Development Company in India
Software Development Company in India
Mobile App Development Company in India
Digital Marketing Company in India

pat said...

vidmate

pat said...

vidmate

pat said...

vidmate

ms archna kumari said...

video downloader app
movies downloader vidmate
all movies download
free video download
Get free movies
free apps download

Team Smartech said...

Awesome blog and very informative. Website Designing Company in Delhi and Website Designing Company in Faridabad .