concerning the Turning Point ResponseCard RF,
having FCC ID R4WRCRF01,
patented as USA 7,330,716.
In this article, I describe in detail the methods by which I have reverse engineered the TurningPoint ResponseCard RF, casually known among students as a "Clicker". This 2.4GHz radio transceiver is used in undergraduate university classrooms for automated roll-call and in-class quizzing or voting. By dumping and analyzing its firmware, one can determine the radio protocol necessary to intercept and forge packets, as well as to build a custom base station. The radio hardware that I have used is a reprogrammed Next HOPE Badge running the GoodFET firmware.
A follow-up article will likely describe the writing of replacement firmware, but that can be easily enough discovered by an enterprising reader. My purpose instead is to provide the information necessary to build compatible products, as well as to teach the technique of reverse engineering these products to find such information when none is available.
Disassembly
The Clicker's keypad is attached only with adhesive, and it can be pulled off after lifting an edge with a knife blade. Beneath the keypad, there are four screws holding the board in place, plus a fifth from the rear of the device. If you are lucky, these will be small Phillips screws, but the unlucky will find tri-wing "Nintendo" screws. I was lucky to have one of each type, but those with neither a Phillips-screwed Clicker nor a tri-wing screwdriver can buy one or try one of these tricks.
In either case, it isn't strictly necessary to open your clicker, as test-points for dumping and replacing its firmware are accessible from the battery compartment. Further, the radio communications are accessible with no hardware access whatsoever.
Hardware
The Clicker is built upon a Nordic nRF24E1 chip, which combines an 8051 microcontroller with an nRF2401 radio transceiver. Although the two cores have been combined into a single package, the 8051 core speaks to the radio through a few bit-field registers and an internal SPI bus, which is shared with the external SPI bus.
As the nRF24E1 lacks internal non-volatile storage, a CAT25C32 (pdf) SPI EEPROM is used for program and configuration storage. Within the microcontroller, there is a masked ROM bootloader from 8000h to 81FFh that loads executable code from the EEPROM into executable RAM from 0000h to 0FFFh.
Dumping Firmware
At the base of the circuit board's primary side, there are test points for the SPI EEPROM. As the default firmware only uses the SPI bus when buttons are pressed, this EEPROM may be dumped at any point after the device has booted. The test points are as follows, which should be matched to those of equivalent names in the GoodFET SPI Table. They were determined by use of a continuity tester.
T4 | MISO |
T5 | SCK |
T6 | MOSI |
T3 | !CS |
T1 | VCC |
GND | GND |
In order to dump the firmware, I quickly wrote a GoodFET client for the 25C32 using its datasheet. A read is performed by sending {0x02, AL, AH, 0} as a SPI transaction, with the result coming back as the fourth byte. Doing it this way with the GoodFET's SPI driver is slower than having C code within the GoodFET dump the whole ROM, but it's fast enough for a dump and takes very little code.
From this point, I dumped the firmware with 'goodfet.spi25c dump image.hex', converted the Intel Hex file to binary, and popped it open in Emacs/hexl. The result looks something like the following, whose format is described in the nRF24E1 datasheet. The opening passage is {u8 config, u8 entry offset, u8 blockcount}. Here {0x0B, 0x07, 0x0B} means that executable code begins at byte 0x07, and that the total image length is 0x0B*256==2,816 bytes. (Additional space within the SPI ROM is unused and left as 0xFF.)
To produce an image suitable for a disassembler, I cut the bytes before 0x07 to make an image beginning with {0x02, 0x0A, 0xB7, ...}. The extra bytes in this region are the serial number and default frequency, but we'll get back to that later.
Firmware Analysis
As the firmware is only three kilobytes, it doesn't take terribly long to reverse engineer. First, the Special Function Registers (SFR) which are defined on pages 79 and 81 of the nRF24E1 datasheet are fed to the disassembler.
(I'm using IDA Pro here, but any 8051 disassembler with a decent text editor could suffice. All of the following function labels are from my imagination, while Special Function Registers (SFRs) come from the nRF24E1 datasheet.)
For example, "MOV 0xA0, #0x80" is rather opaque, but "MOV RADIO, #0x80" makes it clear that the immediate value 0x80 is being placed into the RADIO register. Page 89 of the datasheet will then explain that the high bit of the radio register is power control, so this instruction is powering up the radio for use. Similarly, "SETB RADIO.3" is setting the fourth bit of the RADIO register, which the datasheet describes as raising the CS signal.
Once the SFR addresses are known, it becomes useful to search for them in order to identify the I/O routines. In the nRF24E1, the radio is accessed across a SPI bus, so a good first step is to identify the SPI routine. The function containing this code will always include a MOV involving the SPI_DATA register.
Having this, a list of cross-references quickly shows that while few functions call the SPIRXTX function, each calls it many times. This is because the author has chosen to repeatedly call that function with immediate values, rather than to dump an array of bytes with a for(){} loop.
While the disassembler can automatically identify the function entry points in the table above, it is not capable of giving them English names or descriptions. To understand how this is done, it is necessary to read the datasheets of the SPI devices.
The SPI EEPROM chip, a CAT25C32, is used by dropping the !CS line then writing an opcode byte followed by its parameters or results. Opcodes include WREN/WRDI for write protection, RDSR/WRSR for accessing a status register, and READ/WRITE for reading and writing bytes. A WRITE may only be performed when the external !WP pin is low and the software write protect has been disabled by opcode. A transaction begins when !CS drops low and ends when it drops high.
To identify the function which reads a byte from the 25C32, a few things can be safely assumed: (1) The function will begin by dropping some I/O pin (!CS). (2) The function will then broadcast the READ opcode, 0x03. (3) It will then broadcast a sixteen bit parameter; that is, DPL followed by DPH. (4) Finally, it will return the result of a fourth SPIRXTX call. In pseudocode, that would be something like
SPIROMPEEK(u16 ADR){
SPIRXTX(0x03);
SPIRXTX(ADRL);
SPIRXTX(ADRH);
return SPIRXTX();
}
Sure enough, one of the few functions calling SPIRXTX does exactly this. The constant pushing and popping of the parameters is a quirk of the compiler, which might possibly allow it to be identified. From the code below, it is clear that P0.0 is the !CS line of the CAT25C32.
The SPIROMPOKE function looks similar, except that two transactions are performed. First the WREN (0x06) opcode is sent to enable writing, then WRITE (0x02) is used to perform the actual write.
The other SPI operations concern the nRF2401 radio core, which behaves differently from the EEPROM. Rather than transactions being an opcode followed by parameters, there is only a single SPI register that must be completely written during a transaction. A second register, selected by the CE line, contains the packets.
The configuration is set by one big register, sent MSBit first. If fewer than the needed bytes are sent, the value is right-aligned into the lower bytes of the register. That is, the last byte sent is always (CHAN<<1)|RXMODE and the second to last always describes the radio configuration.
Searching around a bit yields the RADIOWRCONFIG function, the tail of which is below. It can be seen from the code that the 0x1A IRAM byte holds the channel number. That is, if 0x20 is stored at 0x1A, the radio will be configured to 2,432 MHz. The other configuration bytes reveal that the MAC addresses are 24 bits, the checksum is 16 bits, and the device broadcasts at maximum power sourced from a 16MHz crystal. (That the configured crystal is identical to the one on the board is very important. Some enterprising coders will lie to a chip about its crystal in order to access an unsupported radio frequency.)
At this point, it still remains to sniff traffic is to find the target address to which packets are broadcast as well as the frequency. We'll start with the address, because that's a bit easier.
The TXPACKET function involves a lot of PUSH and POP instructions, but it otherwise looks very similar to the RADIOWRCONFIG function, in that a series of bytes are written in order with repeated function calls to SPIRXTX. In pseudocode, this function becomes the following. From the radio documentation and configuration, it is clear that the first three bytes will be the target MAC address. From the RADIOWRCONFIG() function, it is equally clear that the three bytes at 0x1B are the receiving MAC address of the unit. (The parameter of the function happens to be the button press, as can be determined by tracking the keyboard I/O routines or viewing a few packets.)
void TXPACKET(u8 button){
RADIOHOP(); //set channel
//Target MAC address
SPIRXTX(&0x1E);
SPIRXTX(&0x1F);
SPIRXTX(&0x20);
//Source MAC address
SPIRXTX(&0x1B);
SPIRXTX(&0x1C);
SPIRXTX(&0x1D);
//Data value
SPIRXTX(button);
}
The radio itself will append a 16-bit CRC; therefore, the full packet then becomes {u24 tmac, u24 smac, u8 button}.
To determine the value of the target MAC address, just grep the disassembly for "mov" and one of 0x1E, 0x1F, 0x20. The relevant instructions are as follows, setting the target MAC address to 0x123456. (In 8051 notation, the first instruction moves the immediate constant #0x12 into byte 0x1E of IRAM.)
mov 0x1E, #0x12
mov 0x1F, #0x34
mov 0x20, #0x56
As this point, it would be possible to scan each channel for a few seconds, listening for packets sent to that address, but it's classier to find the value by static analysis. Acting on the hunch that the configuration is held in EEPROM and looking for references to the SPIROMPEEK() function, the READIDFREQ() function can be found. As can be seen in the fragment below, EEPROM[6] holds the channel number while the MAC address is at EEPROM[3,4,5].
As the EEPROM begins with "0b 07 0b 15 79 1b 29", it's clear that the MAC address of the unit from which it came is 0x15791B and that it is broadcasting on 2400+0x29=2441MHz. This can be double-checked by the serial number "15791B" being printed on the label.
Implementation
Knowing the modulation scheme, target address, and packet contents, it becomes possible to sniff traffic from a Clicker. This is performed by use of the GoodFET firmware on a Next Hope badge, my prior tutorial for which describes the process of packet sniffing.
The NHBadge board contains an nRF24L01+ radio, which differs dramatically from the nRF2401 in terms of how it is configured. Still, the radios are sufficiently compatible. The following hack of the goodfet.nrf client allows packets to be sniffed from the air with proper checksumming.
Sure enough, here are some packets of the 5 button being pressed on unit 1F8760. The keypress is the final byte in ASCII.
Response Codes
Now that it is clear how to receive and recognize button presses, it becomes necessary to reverse engineer the response codes which might be sent from the access point. Without hearing a reply of at least an ACK, the Clicker will continue to broadcast each message more than three hundred times. This takes more than ten seconds, during which all other key presses are ignored.
The broadcast loop within the MAIN() function would look a little like this in C.
for(count=0;count< MAXCOUNT && !reply;count++){
TXPACKET(button);
reply=RADIORX();
}
switch(reply){...}
This region is easy enough to find, but there's another command mode. An easier target is the channel hopping routine, which constantly broadcasts 0x3F while incrementing the channel, sticking with the last one on which a reply of 0x18 was received. Channels 1 through 83 are attempted; that is, 2,401 MHz to 2,483MHz at 1MHz steps.
Checking this code within the MAIN() function reveals that its effect is to blink the green LED (P1.1) six times, exiting the broadcast loop. Other commands include 0x04 (LED Off), 0x06 (LED Green), 0x15 (LED Red), 0x11 (Blink Green), 0x14 (Blink Red), and 0x18 (Blink Green, Channel Lock). All undefined opcodes set the red LED.
Conclusions
By sniffing traffic within a classroom, it is possible to watch votes as they are being cast by students. Similarly, packets could be broadcast by a reprogrammed Clicker or NHBadge to make a student in virtual attendance, automatically voting with the majority so as to gain perfect attendance and a solid C quiz average. Where instant feedback is available, this might even allow for a solid A quiz average. Without taking advantage of the masked-ROM option of the nRF24E1, the code cannot be even slightly protected from extraction and reverse engineering.
Less adventurous users can jam the network by running 'goodfet.nrf carrier 2441000000' to hold a carrier wave on the channel. The only attempt at a frequency change is made when pressing the GO button, at which point the new channel can be discovered and similarly jammed.
Since performing this work, it has come to my attention that a USRP plugin for doing this to the competing 900MHz iClicker product is available as http://gr-clicker.sourceforge.net/. Additionally, the infrared Clicker units were broken with a little tool called Survey Says. I have ordered more sophisticated Clicker models from CPS and Turning Point, and proper descriptions of them will soon follow.
315 comments:
«Oldest ‹Older 201 – 315 of 315please check this to confirm Speechelo Review
thanks for the same Roblox Robux
can anyone check this out Roblox Robux
Great Content & Thanks For Sharing With oflox. Do You Want To Know How To Earn Money From Helo App
this great spotify codes
best and great and amazing playstation codes
Great share!
I love this bucket list and you know you're right. Sand blasting machine everything takes time and we all have the same amount of hours in a day so put them to good use. We all have to start somewhere and your plan is perfect. I understand the way of the attractive to the customer with the products.
Sand Blasting Machines like shot blasting machine, sand blasting machine, and grit blasting machines, Wood Working Machinery Dust Extraction unit, Abrasive Blasting Media and various others. Keep it works and share with us your latest information. My time will come but I know I'm on the right path.
They are similar to small communities that you own - check them out if you haven't already. It's all got a lot better than before!t.Value that list of thousands but I'll get there.
Thanks for sharing. Have a nice week ahead.
Regards,
Ankit Sharma.
this is amazing post itunes code
got this on internet walmart code
Thank you for sharing, I am very happy to know your blog. Here are some blogs I would like to send you. Please don't delete the link, hi
mo da dep
game nổ hũ đổi thưởng uy tín
bắn cá đổi thưởng 2021
làm cavet xe
this great post amazon codes
mobile app development company in Delhi
Hello everyone I want to introduce you guys to a group a private investigators who can help you with information you need in any situation in life and they are ready to follow you step by step until your case is cleared just contact +17078685071 and you will happily ever after
will smith net worth
Willard Carroll Smith Jr. is an American actor, producer and rapper. In April 2007, Newsweek called him & quot;the most powerful actor in Hollywood
have to check this walmart gift card
Good One..netflix codes
get the best among us
Great information...Your post the very informative i have learned some information about your blog thank you for Sharing the great information.....
Domestic Lifts Manufacturers in Ghaziabad
Domestic Lifts Manufacturers in Delhi NCR
v informative content.
ac maintenance dubai 24/7
emergency plumber dubai
v informative content.
ac maintenance dubai 24/7
emergency plumber dubai
What an amazing post admin really great post thanks for this.
viva video for laptop
viva video lite for PC
snapseed for Mac PC
how to change background color using snapseed
play stored for PC download
cam scanner apk for PC
dzone
spreaker
smallbusinessforums
ted
blognigeria
If you are a youtuber, then know How To Get Sponsorship For YouTube Channel for free!
Thanks for the interesting content. I like your post and your blog is amazing.
If you are interested in Video Downloader apps you can check my blog site. It is new and really informative.
VidMate Movie Download
Thanks for Sharing such an great information keep it up Digifixers
Like it.
https://www.surat-training-course.com/web-designing-training-course-surat
Bài viết rất hay!
Quà tặng doanh nghiệp giá rẻ tại hà nội
Quà tặng nhân viên cuối năm ở đâu chất lương và uy tín
http://progforum.ir/members/kayley.9520/#about
Thanks for the interesting content. I like your post and your blog is amazing.
If you are interested in Video Downloader apps you can check my blog site. It is new and really informative.
VidMate Download 2018
BC Bank Mitra aims to serve its valued customers in the best possible way. We provide banking services to people living in remote areas, especially the
lower-income group without a bank account. CSP provider offers mini bank facilities to people.
We have tie-ups with almost all major banks such as State Bank, Central Bank, Allahabad Bank, Indian Bank, Yes Bank, PNB and many more.
CSP Apply
CSP Provider
CSP Registration
Mua vé tại Aivivu, tham khảo
vé máy bay đi Mỹ bao nhiêu tiền
vé máy bay thanh hóa đi hồ chí minh
vé máy bay từ chu lai đi hà nội
vé máy bay hn nha trang
vé máy bay sài gòn đà lạt pacific airlines
taxi sân bay 2 chiều
combo du lịch nha trang 2021
زیرنویس فارسی The Falcon and the Winter Soldier 2020
gte
gfg46
tgegp
ag8965
obirbiu
ilyititkit
ummyggpet
enretbirieve
xerbitforu
gbitfo
bit
tebitp
afbite
obitru
ilybitkit
bmxmuseum
enretrrrencyb2bieve
xerkhabarforu
ilad
gfohabaron
testeep
aftekowsa
red-news
ozbehrezaei
u4mark
enretrmark
x40billion
British Dissertation Consultants provides Sociology Dissertation Services for sociology topics. With the expertise from our in-house sociologists, we provide the best assistance to students in the UK.
British Dissertation Consultants provides top-notch custom dissertation help UK. For students, dissertation articulation is a tough task. Many are ambivalent to the troubles they face for drafting a dissertation
eagle
metrovideogame
fandom
freeflysystems
fodors
chess
catfish1
kamadoguru
eoshd
mtbr
komodokamadoforu
airsoftsnip
komodoplatform
ocompare
ebangsa
nesco
forumayamadu
pixabay
cegos
n1wanred
myodyssey
i3investor
carigold
bbcgoodfood
fordedgefo
discusscooking
thebloodsugardi
gfoaggag
gforunnnnm
tepytttttta
aftefaggaag
oruagagag
ilykitagagag
ummyaaaaapet
enretrieveagga
xzvvvverforu
gfooooor
gforumagga
tepaggag
afterattttt
oruagagagag
ilykitagah
ummypetagga
enretrievaffaafe
xeshhhrforu
gfoaggag
gforumagga
tepaggaga
afteaggagga
oruaggaag
ilykitzzzzz
ummypetsxxss
enretrieveaaggagt
xerforuagga
Thank you so much for sharing all this amazing information, keep it up.
are you want to make a career in UI Development. check this UI Development Course in Bangalore.
Attend The Best Front-end Certification Training In India From AchieversIT. Practical Front-end Training Sessions With Assured Placement Support From Experienced Faculty. and also proving live projects
AchieversIT Training Institution
Really nice and informative blog, keep it up. Thanks for sharing and I have some suggestions.
if you want to learn pyhton Programming, Join Now Python Training in Bangalore.
Here is a Website- Software Training in Bangalore | AchieversIT
This may help you to find something useful
As a Website Development Company, we gratify to our clients with a complete range of development services like Static Website, Dynamic Website, E-commerce Portal, MLM Portals, and Mobile Applications.
Web Designing and Digital Marketing Company plays a vital role in most industries, right from managing the resources in manufacturing plant to gathering customer reviews in service sector to understand the market better.
Thank you for your blog , it was usefull and informative "AchieversIT is the best Training institute for MERN stack training. MERN stack in bangalore "
Thank you for your blog , it was usefull and informative "AchieversIT is the best Training institute for MERN stack training. MERN stack in bangalore "
Great with detailed information. It is really very helpful for us.
Village Talkies a top-quality professional corporate video production company in Bangalore and also best explainer video company in Bangalore & animation video makers in Bangalore, Chennai, India & Maryland, Baltimore, USA provides Corporate & Brand films, Promotional, Marketing videos & Training videos, Product demo videos, Employee videos, Product video explainers, eLearning videos, 2d Animation, 3d Animation, Motion Graphics, Whiteboard Explainer videos Client Testimonial Videos, Video Presentation and more for all start-ups, industries, and corporate companies. From scripting to corporate video production services, explainer & 3d, 2d animation video production , our solutions are customized to your budget, timeline, and to meet the company goals and objectives.
As a best video production company in Bangalore, we produce quality and creative videos to our clients.
Aivivu chuyên vé máy bay, tham khảo
vé máy bay đi Mỹ tháng nào rẻ nhất
từ mỹ về việt nam được chưa
vé máy bay từ đức về việt nam giá rẻ
bay từ nga về việt nam
ve may bay tu anh ve viet nam
máy bay từ pháp về việt nam
You can get all the online latest Faridabad news and updates on only Faridabad Jyoti News channel. Read all breaking news including sports, national, crime, Delhi NCR, politics news and business news headlines online on Faridabad Jyoti News channel.
https://www.faridabadjyoti.com/
gfzzzzzzo
gforzzzzum
tepjjjjjjjjj
aftezzzzzzzz
oruyyyyyyyy
ilykzzzzzzit
umzzzzzzmypet
enretrzztttttieve
xerffffffffffforu
gfozzzzzz
gforumzzzzzzzz
tepzzzzzzzzz
afteyyyyy
ohhhhhhru
ilykitiiiiiiii
ummyyyyyyypet
enrrrrrretrieve
xeryyyyyyaaaforu
gfoooooooooooo
gforttttttaum
tepayyyyyyyy
attttttfte
oruyayaay
ilykizzzzzzzzt
ummypetayyyyyy
enretyyae
xezzzzzzzzrforu
gfozzzzz
gfzzzorum
teppppppp
afteraaaaa
oruwwwwwwwe
ilykitttttta
ummypeteeeeee
enffffa
xerzzzzzzforu
gfogjgj
gfzzzzorum
tephjhhj
afteeeeeee
oruzzzzz
ilykizzzzzzzzz
ummypezzzzzzt
enhahse
xerzzbbbbbbforu
Thank you for sharing this article please visit here Dental Implant in Jaipur
dental clinic in Jaipur
dentist in Jaipur
Root Canal Treatment in Jaipur
A great post. Thank you for sharing.
Please visit for latest Cloud based quality management software Compliancequest
Nice Blog !...
Airo Shot Blast is the Best Shot Blasting Machine Manufacturers in India. Shot Blasting Machine price depends on size & type of shot blasting machine. we are also provide sand blasting machine, shot blasting machine, portable shot blasting machine, shot blasting cabinet, tumblast shot blasting machine, room, nozzle, shot blasting hopper at low price.
We are the Shot Blasting Machine Manufacturer in India at low price the best quality for sale. shot blasting machine price depends on the abrasive tank capacity and type of shot blasting machine in India.
See more :
Shot Blasting Machine
Shot Blasting Machine Manufacturers
Shot Blasting Machine in India
Shot Blasting Machine price
Shot Blasting Machine
Portable Shot Blasting Machine in India
p1
p2
p3
p4
p5
p6
p7
p8
p9
p10
p11
p12
p13
p14
p15
p16
p17
p18
p19
p20
p21
p37
p22
p23
p24
p25
p26
p27
p28
p29
p30
p31
p32
p33
p34
p35
p36
Hi dear, my name is Rani a 22-year-old call girl. If you are looking to meet a wonderful and highly flammable girl tonight, come to me and you will not be disappointed.
Outcall girls
Model
Incall girls
Hotel call girls
Female call girls service
Female
Escort service
Erotic massage
Dating
Call girls WhatsApp
Call girls number
Call girls for party
Call girls
Call girl WhatsApp
Call girl number
Call girl
Relationship
personal service
Outcall girls
Model
Nice Blog !...
Airo Shot Blast is the Best Shot Blasting Machine Manufacturers in India. Shot Blasting Machine price depends on size & type of shot blasting machine. we are also provide sand blasting machine, shot blasting machine, portable shot blasting machine, shot blasting cabinet, tumblast shot blasting machine, room, nozzle, shot blasting hopper, Shot Blasting Machine in Jodhpur at low price.
We are the Shot Blasting Machine Manufacturer’s in India at low price the best quality for sale. portable shot blasting machine price depends on the abrasive tank capacity and type of shot blasting machine in India.
See more :
shot blasting machine in Pune
Portable Shot Blasting Machine in India
Shot Blasting Machine Manufacturers
Shot Blasting Machine in Gurgaon
Portable Shot Blasting Machine in India
Shot Blasting Machine in Delhi
toptan iç giyim tercih etmenizin sebebi kaliteyi ucuza satın alabilmektir. Ürünler yine orjinaldir ve size sorun yaşatmaz. Yine de bilinen tekstil markalarını tercih etmelisiniz.
tutku iç giyim Türkiye'nin önde gelen iç giyim markalarından birisi olmasının yanı sıra en çok satan markalardan birisidir. Ürünleri hem çok kalitelidir hem de pamuk kullanımı daha fazladır.
Digitürk sporun yıldızı paketi Faturalıya ilk 4 ay 49,00 TL, daha sonra ayda yalnızca 154,00 TL. Kredi Kartı ile 12 ay boyunca ayda 119 TL, toplamda 1428 TL.
nbb sütyen hem kaliteli hem de uygun fiyatlı sütyenler üretmektedir. Sütyene ek olarak sütyen takımı ve jartiyer gibi ürünleri de mevcuttur. Özellikle Avrupa ve Orta Doğu'da çokça tercih edilmektedir.
yeni inci sütyen kaliteyi ucuz olarak sizlere ulaştırmaktadır. Çok çeşitli sütyen varyantları mevcuttur. iç giyime damga vuran markalardan biridir ve genellikle Avrupa'da ismi sıklıkla duyulur.
iç giyim ürünlerine her zaman dikkat etmemiz gerekmektedir. Üretimde kullanılan malzemelerin kullanım oranları, kumaşın esnekliği, çekmezlik testi gibi birçok unsuru aynı anda değerlendirerek seçim yapmalıyız.
iç giyim bayanların erkeklere göre daha dikkatli oldukları bir alandır. Erkeklere göre daha özenli ve daha seçici davranırlar. Biliyorlar ki iç giyimde kullandıkları şeyler kafalarındaki ve ruhlarındaki özellikleri dışa vururlar.
hey this is teju it was a fantastic article to read I loved it thanks for sharing
free social bookmrking sites list
updated social bookmarking sites list
new social bookmarking sites list 2020
They can guide you to remarkable places and you will have every chance to take advantage of their sexual advantage. They expect the man to be naturally horny and there is nothing to hide from her. They can be gentlemen and surprise her, but she is always ready to take action anywhere.
Agra Escorts Service |
Escorts In Mainpuri |
Escorts In Mathura |
Escorts In Meerut |
Escorts In Mirzapur |
Escorts In Moradabad |
Escorts In Muzaffarnagar |
Escorts In Noida |
Usurp the top position on search engines after availing of our Website Development Services Delhi. Webgross offers website development coming from efficient coders who incline towards user intent and satisfaction. Trust us as we prove ourselves to you through sheer hard work and determination, with availability at your service Content writing services Delhi.
Escorts Services in Ludhiana |
Escorts Service in Ludhiana |
Escort Services In Ludhiana |
Call Girl in Ludhiana |
Independent Call Girl In Ludhiana |
Sexy Call Girl In Ludhiana |
Hot Call Girl in Ludhiana |
Best Call Girl in Ludhiana |
Ludhiana Call Girls |
Interesting post it is very helpful thanks for share it. We have an online store of leather jackets. we are offering worldwide free shipping on every order.
B3 BOMBER JACKETS
AVIATOR JACKETS
DISTRESSED LEATHER JACKETS
V BOMBER LEATHER JACKETS
Nice Blog !
Shot blasting machine manufacturers of shot blasting machine in India. A Shot blasting machine is an enclosed equipment designed for abrasive blasting for cleaning and preparing rough surface.
See More :
Shot blasting machine in India
Thank you for this wonderful information looking forward for more Website Designing Company in Delhi
Great job for publishing such a nice article. Your article isn’t only useful but it is additionally really informative. Thank you because you have been willing to share information with us python course in delhi
The tour package for the best backwater resorts in Kerala is very much affordable, makes every visitor to count on another trip to the best resorts in Kerala.
Excellent information Providing by your Article, Please post some more related topics. I like this post very much.
SUPER KAMAGRA IN DUBAI 100mg
Thanks for the post it was very informative. Pointer Soft provides best CCTV camera installation services.
Great! Thanks for sharing this kind of information it’s really very nice and useful for me. Website Designing Company in South Delhi
We are manufacturer of sand blasting machine
The surface treatment Industry is a manufacturing company. We manufacture sand blasting machines , shot blasting machines, shot peening machine, and their equipment.
Posted blog really impressed me lot here I found tips and new ideas for SEO Content Writing Services India which gave helpful reasons, keep posting new informative blogs with us after all I am your regular blog reader Content writing services Delhi.
Hello, I am Arpita Sinha from Delhi
I have Read your post and found it interesting...
Thanks for sharing
Have a Great Day
Graphic design course in Delhi
Hello Everyone These are Some Of My Website That I Will Rank In Google Search and Make Some
Money Online From Google AdSense So You Can Also Check These Website.
vidmate download
blog
GBWhatsapp
free fire name
YouTube Thumbnail Downloader
Tamilrockers
JPG to PDF
Hope I Will Rank it in Google as Fast as Possible. Thanks.
It's an impressive blog post where I have found influenced knowledge which helped me lot in my passion check for more information Blog sites thanks for providing blog post with us.
How to Start a Blog: Easy Guide to Make $302k One Year
In this article, we will talk about how to start a blog. Seven easy steps will help you in creating your Blog. People have earned massive amounts with their blogs. They have made $1 million in a brief period.
how to create a blog, how to make a blog, How to Start a Blog, how to start writing a blog
https://www.newspostalk.com/people-choice/how-to-start-a-blog-easy-guide-to-make-302k-one-year/
How to Make Money on YouTube: A platform that can give you high profits
Thinking about how to make money on YouTube? YouTube is no longer restricted to huge influencers or musicians. It has a good number of opportunities for everyday people.
how to earn money from youtube, how to make money on youtube
https://www.newspostalk.com/people-choice/how-to-earn-money-from-youtube/
Newspostalk - Global News Platform
Newspostalk covers all global news & provide quality news in a various niche like Continents News, World News, Business News, Sports News, Entertainment News, Health News, technology News, Science News.
Continents News, World News, Business News, Sports News, Entertainment News, Health News, technology News, Science News
https://www.newspostalk.com/
Lab Grown Diamonds on the internet at the lowest prices when compared with the other Man Made Diamonds Sellers. Unique Collection, Best Quality Guaranteed!
Thanks for sharing amazing information keep posting!
mangaowl
Get the best deals on Huawei Switches and find everything you'll need to improve your home office setup at Cloud Infotech.
Great! Thanks for sharing this kind of information it’s really very nice and useful for me.
icici eazypay This app allows for free mobile transactions and proves to be beneficial for all retailers, dealers and professionals as this app helps them to receive instant cash payments to their customers by selecting any options available in most digital modes.
JBL Car Speakers Amazon proudly maintain one of the largest JBL – Car Speakers available. JBL has a speaker that fits almost all types of vehicles and budget. Obviously there is no place near our cheapest type of car speakers, Chinese New Year 2022Chinese New Year Celebrations Also called The Festival of Spring, in China begin with the 23rd day of twelve lunar months of the Chinese calendar. The celebration lasts approximately 23 days, and it ends at the end of first lunar month following the year according to the Chinese calendar.
복수자카지노 - 【카지노사이트】바카라사이트,파라오카지노,샌즈카지노,SM카지노
Thanks for posting, it is really helpful. We are a leading Digital Marketing & Web Designing Company in Delhi. Visit us.
Digital Marketing comapany in Delhi
Web Designing comapany in Delhi
This article is very Interesting information Thanks for Sharing. Are you looking for Top Interior Designing Institute in Delhi | Interior Designing Course Fees Delhi
Thanks for this. I really like what you've posted here and wish you the best of luck with this blog and thanks for sharing. Website Designing Company in Delhi
I like this post. I needed a post like this and I’m impressed Thank you for sharing this.
https://jeetechacademy.com/web-development-course/
Kickr Technology's development team help us deliver beautiful, innovative software applications and mobile apps that simplify various business processes. We offer optimal solutions that work with your team to augment your capabilities and simplify the development process.
Thank you for sharing this article please visit here Full Mouth Dental Implant in Jaipur
Laser Dentistry In Jaipur
Smile Makeover in Jaipur
Invisiable Brace in Jaipur
Teeth Whitening in Jaipur
Best Digital Marketing Serices-Best SEO Optimization Services Provide We are provide SEO Optimization Services to Client Website Increase costumer to give Best Facility https://thebravemedia.com .
I am running Responsive Website Designing Company in Delhi and Top Digital Marketing Agencies in Delhi. That blog will help me for promote my website.
Your post is good. Thank you for sharing! Mobile App Development Company
Escape the daily grind and relax your mind, body and soul at Whether you're a dedicated worker or an overworked student, our expert massage therapists are here to relieve tension in tense muscles with their b2b spa massage in bangalore ultimate skill set of skills!
The staff with Body to Body Massage in hyderabad offer all modern amenities at our center to help you relax and at ease. The atmosphere is awe-inspiring due to the pleasant scent of incense and the peacefulnes b2b spa massage in hyderabads that you'll experience at our center located in hyderabad.
Safe and secure massage spa Bangalore, for female also therapies are there Indian Ayurveda massage to reduce stress. Thai massages for full body stretching. Book Now Visit b2b massage in bangalore
massage is a great way to relieve muscle pain, soreness, and tension. It doesn’t matter whether this pain was caused by physical or mental stress, the massage will work it out for you.
Visit Body to Body spa near me
It is a nice post to keep sharing valuable information like this. Graphic design courses fees in delhi
thank you for sharing this information with us.
Web Designing Company in Delhi
Good Job...!
The Gaia Hotel Bandung
Rekomendasi hotel Danau Toba
Cheap flight ticket
We are a company engaged in the field of tour and travel, as a means and infrastructure for industry
travel and tourism. The best travel agency provides tourist bus rental, car rental and selling plane tickets
in Medan.
Pressure point massage is a treatment that applies body massage spa near me pressure to specific points on the feet. These points correspond to all organs, glands and tissues in your body. It promotes relaxation, increases energy, and balances the body. The foot massage chair allows the recipient to relax and sit comfortably on it.
I read you blog and it was mind blowing. I write a blog on Color Coated Steel Roofing Sheet Manufactures
We have the perfect spa day for you if you want a relaxing spa experience in a tranquil environment with dimly lit aromatherapy
body massage in bangalore candles and soothing music.
The spas are designed to help you relax and B2B massage unwind.codella is a well-known Spa in Koramangala. We provides best spa services in Bangalore.
Great, your blog was very nice. Thanks for sharing it if anyone wants Research Writing freelancer then Paperub is a platform where you get a skilled freelancer according to your requirement. Visit Paperub to get a freelancer in minutes.
web designing course
web development course
digital marketing course
full stack development course
A very informative blog that almost solved all my doubts. I would like to appreciate the efforts put in by you to write it and help the readers. However, if you are looking a mobile app development company, then you should check Appic Softwares, visit our website at Automotive Mobile App Development.
The ayurvedic practitioner is therefore looking to
balance the body and mind, to ferret B2B spa in pune out health problems before they happen or to nip
them in the bud before they do any real harm.
Looking for the Best Custom Home Builders in Melbourne, Australia? Our expert team will work with you to create the perfect home that meets your unique needs and style preferences.
Post a Comment