Sunday, July 4, 2010

Reversing an RF Clicker

by Travis Goodspeed <travis at radiantmachines.com>
concerning the Turning Point ResponseCard RF,
having FCC ID R4WRCRF01,
patented as USA 7,330,716.


Turning Point Clicker

In this article, I describe in detail the methods by which I have reverse engineered the TurningPoint ResponseCard RF, casually known among students as a "Clicker". This 2.4GHz radio transceiver is used in undergraduate university classrooms for automated roll-call and in-class quizzing or voting. By dumping and analyzing its firmware, one can determine the radio protocol necessary to intercept and forge packets, as well as to build a custom base station. The radio hardware that I have used is a reprogrammed Next HOPE Badge running the GoodFET firmware.

A follow-up article will likely describe the writing of replacement firmware, but that can be easily enough discovered by an enterprising reader. My purpose instead is to provide the information necessary to build compatible products, as well as to teach the technique of reverse engineering these products to find such information when none is available.

Disassembly


The Clicker's keypad is attached only with adhesive, and it can be pulled off after lifting an edge with a knife blade. Beneath the keypad, there are four screws holding the board in place, plus a fifth from the rear of the device. If you are lucky, these will be small Phillips screws, but the unlucky will find tri-wing "Nintendo" screws. I was lucky to have one of each type, but those with neither a Phillips-screwed Clicker nor a tri-wing screwdriver can buy one or try one of these tricks.
Devil Screws

In either case, it isn't strictly necessary to open your clicker, as test-points for dumping and replacing its firmware are accessible from the battery compartment. Further, the radio communications are accessible with no hardware access whatsoever.

Hardware


The Clicker is built upon a Nordic nRF24E1 chip, which combines an 8051 microcontroller with an nRF2401 radio transceiver. Although the two cores have been combined into a single package, the 8051 core speaks to the radio through a few bit-field registers and an internal SPI bus, which is shared with the external SPI bus.

As the nRF24E1 lacks internal non-volatile storage, a CAT25C32 (pdf) SPI EEPROM is used for program and configuration storage. Within the microcontroller, there is a masked ROM bootloader from 8000h to 81FFh that loads executable code from the EEPROM into executable RAM from 0000h to 0FFFh.

Hacked Clicker Board

Dumping Firmware


At the base of the circuit board's primary side, there are test points for the SPI EEPROM. As the default firmware only uses the SPI bus when buttons are pressed, this EEPROM may be dumped at any point after the device has booted. The test points are as follows, which should be matched to those of equivalent names in the GoodFET SPI Table. They were determined by use of a continuity tester.
T4MISO
T5SCK
T6MOSI
T3!CS
T1VCC
GNDGND


In order to dump the firmware, I quickly wrote a GoodFET client for the 25C32 using its datasheet. A read is performed by sending {0x02, AL, AH, 0} as a SPI transaction, with the result coming back as the fourth byte. Doing it this way with the GoodFET's SPI driver is slower than having C code within the GoodFET dump the whole ROM, but it's fast enough for a dump and takes very little code.
Quick and Dirty 25C32 Driver

From this point, I dumped the firmware with 'goodfet.spi25c dump image.hex', converted the Intel Hex file to binary, and popped it open in Emacs/hexl. The result looks something like the following, whose format is described in the nRF24E1 datasheet. The opening passage is {u8 config, u8 entry offset, u8 blockcount}. Here {0x0B, 0x07, 0x0B} means that executable code begins at byte 0x07, and that the total image length is 0x0B*256==2,816 bytes. (Additional space within the SPI ROM is unused and left as 0xFF.)
Clicker ROM

To produce an image suitable for a disassembler, I cut the bytes before 0x07 to make an image beginning with {0x02, 0x0A, 0xB7, ...}. The extra bytes in this region are the serial number and default frequency, but we'll get back to that later.
Clicker Dev Kit

Firmware Analysis


As the firmware is only three kilobytes, it doesn't take terribly long to reverse engineer. First, the Special Function Registers (SFR) which are defined on pages 79 and 81 of the nRF24E1 datasheet are fed to the disassembler.

(I'm using IDA Pro here, but any 8051 disassembler with a decent text editor could suffice. All of the following function labels are from my imagination, while Special Function Registers (SFRs) come from the nRF24E1 datasheet.)

For example, "MOV 0xA0, #0x80" is rather opaque, but "MOV RADIO, #0x80" makes it clear that the immediate value 0x80 is being placed into the RADIO register. Page 89 of the datasheet will then explain that the high bit of the radio register is power control, so this instruction is powering up the radio for use. Similarly, "SETB RADIO.3" is setting the fourth bit of the RADIO register, which the datasheet describes as raising the CS signal.

Once the SFR addresses are known, it becomes useful to search for them in order to identify the I/O routines. In the nRF24E1, the radio is accessed across a SPI bus, so a good first step is to identify the SPI routine. The function containing this code will always include a MOV involving the SPI_DATA register.
SPIRXTX for 8051

Having this, a list of cross-references quickly shows that while few functions call the SPIRXTX function, each calls it many times. This is because the author has chosen to repeatedly call that function with immediate values, rather than to dump an array of bytes with a for(){} loop.
Functions calling SPITXRX

While the disassembler can automatically identify the function entry points in the table above, it is not capable of giving them English names or descriptions. To understand how this is done, it is necessary to read the datasheets of the SPI devices.

The SPI EEPROM chip, a CAT25C32, is used by dropping the !CS line then writing an opcode byte followed by its parameters or results. Opcodes include WREN/WRDI for write protection, RDSR/WRSR for accessing a status register, and READ/WRITE for reading and writing bytes. A WRITE may only be performed when the external !WP pin is low and the software write protect has been disabled by opcode. A transaction begins when !CS drops low and ends when it drops high.

To identify the function which reads a byte from the 25C32, a few things can be safely assumed: (1) The function will begin by dropping some I/O pin (!CS). (2) The function will then broadcast the READ opcode, 0x03. (3) It will then broadcast a sixteen bit parameter; that is, DPL followed by DPH. (4) Finally, it will return the result of a fourth SPIRXTX call. In pseudocode, that would be something like
SPIROMPEEK(u16 ADR){
SPIRXTX(0x03);
SPIRXTX(ADRL);
SPIRXTX(ADRH);
return SPIRXTX();
}


Sure enough, one of the few functions calling SPIRXTX does exactly this. The constant pushing and popping of the parameters is a quirk of the compiler, which might possibly allow it to be identified. From the code below, it is clear that P0.0 is the !CS line of the CAT25C32.
SPIROMPEEK

The SPIROMPOKE function looks similar, except that two transactions are performed. First the WREN (0x06) opcode is sent to enable writing, then WRITE (0x02) is used to perform the actual write.

The other SPI operations concern the nRF2401 radio core, which behaves differently from the EEPROM. Rather than transactions being an opcode followed by parameters, there is only a single SPI register that must be completely written during a transaction. A second register, selected by the CE line, contains the packets.

The configuration is set by one big register, sent MSBit first. If fewer than the needed bytes are sent, the value is right-aligned into the lower bytes of the register. That is, the last byte sent is always (CHAN<<1)|RXMODE and the second to last always describes the radio configuration.
nRF2401 Config Register

Searching around a bit yields the RADIOWRCONFIG function, the tail of which is below. It can be seen from the code that the 0x1A IRAM byte holds the channel number. That is, if 0x20 is stored at 0x1A, the radio will be configured to 2,432 MHz. The other configuration bytes reveal that the MAC addresses are 24 bits, the checksum is 16 bits, and the device broadcasts at maximum power sourced from a 16MHz crystal. (That the configured crystal is identical to the one on the board is very important. Some enterprising coders will lie to a chip about its crystal in order to access an unsupported radio frequency.)
Clicker RF Config

At this point, it still remains to sniff traffic is to find the target address to which packets are broadcast as well as the frequency. We'll start with the address, because that's a bit easier.

The TXPACKET function involves a lot of PUSH and POP instructions, but it otherwise looks very similar to the RADIOWRCONFIG function, in that a series of bytes are written in order with repeated function calls to SPIRXTX. In pseudocode, this function becomes the following. From the radio documentation and configuration, it is clear that the first three bytes will be the target MAC address. From the RADIOWRCONFIG() function, it is equally clear that the three bytes at 0x1B are the receiving MAC address of the unit. (The parameter of the function happens to be the button press, as can be determined by tracking the keyboard I/O routines or viewing a few packets.)
void TXPACKET(u8 button){
RADIOHOP(); //set channel

//Target MAC address
SPIRXTX(&0x1E);
SPIRXTX(&0x1F);
SPIRXTX(&0x20);

//Source MAC address
SPIRXTX(&0x1B);
SPIRXTX(&0x1C);
SPIRXTX(&0x1D);

//Data value
SPIRXTX(button);
}

The radio itself will append a 16-bit CRC; therefore, the full packet then becomes {u24 tmac, u24 smac, u8 button}.

To determine the value of the target MAC address, just grep the disassembly for "mov" and one of 0x1E, 0x1F, 0x20. The relevant instructions are as follows, setting the target MAC address to 0x123456. (In 8051 notation, the first instruction moves the immediate constant #0x12 into byte 0x1E of IRAM.)
mov 0x1E, #0x12
mov 0x1F, #0x34
mov 0x20, #0x56


As this point, it would be possible to scan each channel for a few seconds, listening for packets sent to that address, but it's classier to find the value by static analysis. Acting on the hunch that the configuration is held in EEPROM and looking for references to the SPIROMPEEK() function, the READIDFREQ() function can be found. As can be seen in the fragment below, EEPROM[6] holds the channel number while the MAC address is at EEPROM[3,4,5].
Clicker Config

As the EEPROM begins with "0b 07 0b 15 79 1b 29", it's clear that the MAC address of the unit from which it came is 0x15791B and that it is broadcasting on 2400+0x29=2441MHz. This can be double-checked by the serial number "15791B" being printed on the label.

Implementation


Knowing the modulation scheme, target address, and packet contents, it becomes possible to sniff traffic from a Clicker. This is performed by use of the GoodFET firmware on a Next Hope badge, my prior tutorial for which describes the process of packet sniffing.

The NHBadge board contains an nRF24L01+ radio, which differs dramatically from the nRF2401 in terms of how it is configured. Still, the radios are sufficiently compatible. The following hack of the goodfet.nrf client allows packets to be sniffed from the air with proper checksumming.
Sniffing TurningPoint Traffic

Sure enough, here are some packets of the 5 button being pressed on unit 1F8760. The keypress is the final byte in ASCII.
Clicker Sniffing

Response Codes



Now that it is clear how to receive and recognize button presses, it becomes necessary to reverse engineer the response codes which might be sent from the access point. Without hearing a reply of at least an ACK, the Clicker will continue to broadcast each message more than three hundred times. This takes more than ten seconds, during which all other key presses are ignored.

The broadcast loop within the MAIN() function would look a little like this in C.
for(count=0;count< MAXCOUNT && !reply;count++){
TXPACKET(button);
reply=RADIORX();
}
switch(reply){...}


This region is easy enough to find, but there's another command mode. An easier target is the channel hopping routine, which constantly broadcasts 0x3F while incrementing the channel, sticking with the last one on which a reply of 0x18 was received. Channels 1 through 83 are attempted; that is, 2,401 MHz to 2,483MHz at 1MHz steps.
Clicker SYN/ACK

Checking this code within the MAIN() function reveals that its effect is to blink the green LED (P1.1) six times, exiting the broadcast loop. Other commands include 0x04 (LED Off), 0x06 (LED Green), 0x15 (LED Red), 0x11 (Blink Green), 0x14 (Blink Red), and 0x18 (Blink Green, Channel Lock). All undefined opcodes set the red LED.

Conclusions


By sniffing traffic within a classroom, it is possible to watch votes as they are being cast by students. Similarly, packets could be broadcast by a reprogrammed Clicker or NHBadge to make a student in virtual attendance, automatically voting with the majority so as to gain perfect attendance and a solid C quiz average. Where instant feedback is available, this might even allow for a solid A quiz average. Without taking advantage of the masked-ROM option of the nRF24E1, the code cannot be even slightly protected from extraction and reverse engineering.

Less adventurous users can jam the network by running 'goodfet.nrf carrier 2441000000' to hold a carrier wave on the channel. The only attempt at a frequency change is made when pressing the GO button, at which point the new channel can be discovered and similarly jammed.

Since performing this work, it has come to my attention that a USRP plugin for doing this to the competing 900MHz iClicker product is available as http://gr-clicker.sourceforge.net/. Additionally, the infrared Clicker units were broken with a little tool called Survey Says. I have ordered more sophisticated Clicker models from CPS and Turning Point, and proper descriptions of them will soon follow.

315 comments:

«Oldest   ‹Older   201 – 315 of 315
Speechelo Review said...

please check this to confirm Speechelo Review

Roblox Robux said...

thanks for the same Roblox Robux

Roblox Robux said...

can anyone check this out Roblox Robux

Sunder said...

Great Content & Thanks For Sharing With oflox. Do You Want To Know How To Earn Money From Helo App

blogo said...

this great spotify codes

blogo said...

best and great and amazing playstation codes

Ankit Manawat said...

Great share!

I love this bucket list and you know you're right. Sand blasting machine everything takes time and we all have the same amount of hours in a day so put them to good use. We all have to start somewhere and your plan is perfect. I understand the way of the attractive to the customer with the products.

Sand Blasting Machines like shot blasting machine, sand blasting machine, and grit blasting machines, Wood Working Machinery Dust Extraction unit, Abrasive Blasting Media and various others. Keep it works and share with us your latest information. My time will come but I know I'm on the right path.

They are similar to small communities that you own - check them out if you haven't already. It's all got a lot better than before!t.Value that list of thousands but I'll get there.

Thanks for sharing. Have a nice week ahead.


Regards,
Ankit Sharma.

blogo said...

this is amazing post itunes code

blogo said...

got this on internet walmart code

Quỳnh Nguyễn said...

Thank you for sharing, I am very happy to know your blog. Here are some blogs I would like to send you. Please don't delete the link, hi
mo da dep
game nổ hũ đổi thưởng uy tín
bắn cá đổi thưởng 2021
làm cavet xe

blogo said...

this great post amazon codes

Tekniko Global said...

mobile app development company in Delhi

Dave said...

Hello everyone I want to introduce you guys to a group a private investigators who can help you with information you need in any situation in life and they are ready to follow you step by step until your case is cleared just contact +17078685071 and you will happily ever after

Alka said...

will smith net worth

Willard Carroll Smith Jr. is an American actor, producer and rapper. In April 2007, Newsweek called him & quot;the most powerful actor in Hollywood

techno said...

have to check this walmart gift card

Gift Card said...

Good One..netflix codes

techno said...

get the best among us

Unknown said...

Great information...Your post the very informative i have learned some information about your blog thank you for Sharing the great information.....
Domestic Lifts Manufacturers in Ghaziabad
Domestic Lifts Manufacturers in Delhi NCR

Dar said...

v informative content.
ac maintenance dubai 24/7
emergency plumber dubai

Dar said...

v informative content.
ac maintenance dubai 24/7
emergency plumber dubai

Karthik Logan said...

What an amazing post admin really great post thanks for this.
viva video for laptop
viva video lite for PC
snapseed for Mac PC
how to change background color using snapseed
play stored for PC download
cam scanner apk for PC

milad said...



dzone



spreaker


smallbusinessforums



ted


blognigeria


Oflox said...

If you are a youtuber, then know How To Get Sponsorship For YouTube Channel for free!

Alexis Gipson said...

Thanks for the interesting content. I like your post and your blog is amazing.

If you are interested in Video Downloader apps you can check my blog site. It is new and really informative.

VidMate Movie Download

Dr.world said...

Thanks for Sharing such an great information keep it up Digifixers

Dipika said...

Like it.
https://www.surat-training-course.com/web-designing-training-course-surat

quatang24k said...


Bài viết rất hay!

Quà tặng doanh nghiệp giá rẻ tại hà nội

Quà tặng nhân viên cuối năm ở đâu chất lương và uy tín

milad said...


http://progforum.ir/members/kayley.9520/#about

Alexis Gipson said...


Thanks for the interesting content. I like your post and your blog is amazing.
If you are interested in Video Downloader apps you can check my blog site. It is new and really informative.

VidMate Download 2018

BC Bank Mitra said...

BC Bank Mitra aims to serve its valued customers in the best possible way. We provide banking services to people living in remote areas, especially the
lower-income group without a bank account. CSP provider offers mini bank facilities to people.
We have tie-ups with almost all major banks such as State Bank, Central Bank, Allahabad Bank, Indian Bank, Yes Bank, PNB and many more.
CSP Apply
CSP Provider
CSP Registration

aivivubooking1 said...

Mua vé tại Aivivu, tham khảo

vé máy bay đi Mỹ bao nhiêu tiền

vé máy bay thanh hóa đi hồ chí minh

vé máy bay từ chu lai đi hà nội

vé máy bay hn nha trang

vé máy bay sài gòn đà lạt pacific airlines

taxi sân bay 2 chiều

combo du lịch nha trang 2021

besayi said...


زیرنویس فارسی The Falcon and the Winter Soldier 2020



besayi said...


gte

gfg46

tgegp

ag8965

obirbiu

ilyititkit

ummyggpet

enretbirieve

xerbitforu

besayi said...


gbitfo

bit

tebitp

afbite

obitru

ilybitkit

bmxmuseum

enretrrrencyb2bieve

xerkhabarforu

besayi said...


ilad

gfohabaron

testeep

aftekowsa

red-news

ozbehrezaei

u4mark

enretrmark

x40billion

Daniel Paul said...

British Dissertation Consultants provides Sociology Dissertation Services for sociology topics. With the expertise from our in-house sociologists, we provide the best assistance to students in the UK.

Daniel Paul said...

British Dissertation Consultants provides top-notch custom dissertation help UK. For students, dissertation articulation is a tough task. Many are ambivalent to the troubles they face for drafting a dissertation

besayi said...

eagle

metrovideogame

fandom

freeflysystems

fodors

chess

catfish1

kamadoguru

eoshd

besayi said...


mtbr

komodokamadoforu

airsoftsnip

komodoplatform

ocompare

ebangsa

nesco

forumayamadu

pixabay

besayi said...


cegos

n1wanred

myodyssey

i3investor

carigold

bbcgoodfood

fordedgefo

discusscooking

thebloodsugardi

besayi said...


gfoaggag

gforunnnnm

tepytttttta

aftefaggaag

oruagagag

ilykitagagag

ummyaaaaapet

enretrieveagga

xzvvvverforu

besayi said...


gfooooor

gforumagga

tepaggag

afterattttt

oruagagagag

ilykitagah

ummypetagga

enretrievaffaafe

xeshhhrforu

besayi said...



gfoaggag

gforumagga

tepaggaga

afteaggagga

oruaggaag

ilykitzzzzz

ummypetsxxss

enretrieveaaggagt

xerforuagga

AchieversIT said...

Thank you so much for sharing all this amazing information, keep it up.
are you want to make a career in UI Development. check this UI Development Course in Bangalore.
Attend The Best Front-end Certification Training In India From AchieversIT. Practical Front-end Training Sessions With Assured Placement Support From Experienced Faculty. and also proving live projects
AchieversIT Training Institution

AchieversIT said...

Really nice and informative blog, keep it up. Thanks for sharing and I have some suggestions.
if you want to learn pyhton Programming, Join Now Python Training in Bangalore.
Here is a Website- Software Training in Bangalore | AchieversIT
This may help you to find something useful

Divinegyaan said...

As a Website Development Company, we gratify to our clients with a complete range of development services like Static Website, Dynamic Website, E-commerce Portal, MLM Portals, and Mobile Applications.

Bit_Binders said...

Web Designing and Digital Marketing Company plays a vital role in most industries, right from managing the resources in manufacturing plant to gathering customer reviews in service sector to understand the market better.

AchieversIT said...

Thank you for your blog , it was usefull and informative "AchieversIT is the best Training institute for MERN stack training. MERN stack in bangalore "

AchieversIT said...

Thank you for your blog , it was usefull and informative "AchieversIT is the best Training institute for MERN stack training. MERN stack in bangalore "

Village Talkies said...

Great with detailed information. It is really very helpful for us.
Village Talkies a top-quality professional corporate video production company in Bangalore and also best explainer video company in Bangalore & animation video makers in Bangalore, Chennai, India & Maryland, Baltimore, USA provides Corporate & Brand films, Promotional, Marketing videos & Training videos, Product demo videos, Employee videos, Product video explainers, eLearning videos, 2d Animation, 3d Animation, Motion Graphics, Whiteboard Explainer videos Client Testimonial Videos, Video Presentation and more for all start-ups, industries, and corporate companies. From scripting to corporate video production services, explainer & 3d, 2d animation video production , our solutions are customized to your budget, timeline, and to meet the company goals and objectives.
As a best video production company in Bangalore, we produce quality and creative videos to our clients.

Huongkv said...

Aivivu chuyên vé máy bay, tham khảo

vé máy bay đi Mỹ tháng nào rẻ nhất

từ mỹ về việt nam được chưa

vé máy bay từ đức về việt nam giá rẻ

bay từ nga về việt nam

ve may bay tu anh ve viet nam

máy bay từ pháp về việt nam

Faridabad Jyoti said...

You can get all the online latest Faridabad news and updates on only Faridabad Jyoti News channel. Read all breaking news including sports, national, crime, Delhi NCR, politics news and business news headlines online on Faridabad Jyoti News channel.

https://www.faridabadjyoti.com/

besayi said...


gfzzzzzzo

gforzzzzum

tepjjjjjjjjj

aftezzzzzzzz

oruyyyyyyyy

ilykzzzzzzit

umzzzzzzmypet

enretrzztttttieve

xerffffffffffforu

besayi said...



gfozzzzzz

gforumzzzzzzzz

tepzzzzzzzzz

afteyyyyy

ohhhhhhru

ilykitiiiiiiii

ummyyyyyyypet

enrrrrrretrieve

xeryyyyyyaaaforu

besayi said...


gfoooooooooooo

gforttttttaum

tepayyyyyyyy

attttttfte

oruyayaay

ilykizzzzzzzzt

ummypetayyyyyy

enretyyae

xezzzzzzzzrforu

besayi said...


gfozzzzz

gfzzzorum

teppppppp

afteraaaaa

oruwwwwwwwe

ilykitttttta

ummypeteeeeee

enffffa

xerzzzzzzforu

besayi said...


gfogjgj

gfzzzzorum

tephjhhj

afteeeeeee

oruzzzzz

ilykizzzzzzzzz

ummypezzzzzzt

enhahse

xerzzbbbbbbforu

DNG Dental Clinic said...

Thank you for sharing this article please visit here Dental Implant in Jaipur
dental clinic in Jaipur
dentist in Jaipur
Root Canal Treatment in Jaipur

ComplianceQuest said...

A great post. Thank you for sharing.

Please visit for latest Cloud based quality management software Compliancequest

Sumer said...

Nice Blog !...
Airo Shot Blast is the Best Shot Blasting Machine Manufacturers in India. Shot Blasting Machine price depends on size & type of shot blasting machine. we are also provide sand blasting machine, shot blasting machine, portable shot blasting machine, shot blasting cabinet, tumblast shot blasting machine, room, nozzle, shot blasting hopper at low price.
We are the Shot Blasting Machine Manufacturer in India at low price the best quality for sale. shot blasting machine price depends on the abrasive tank capacity and type of shot blasting machine in India.
See more :
Shot Blasting Machine
Shot Blasting Machine Manufacturers
Shot Blasting Machine in India
Shot Blasting Machine price
Shot Blasting Machine
Portable Shot Blasting Machine in India

besayi said...




p1
p2
p3
p4
p5
p6
p7
p8
p9
p10
p11
p12
p13
p14
p15
p16
p17
p18
p19
p20
p21
p37
p22
p23
p24
p25
p26
p27
p28
p29
p30
p31
p32
p33
p34
p35
p36

Sweta Basu said...

Hi dear, my name is Rani a 22-year-old call girl. If you are looking to meet a wonderful and highly flammable girl tonight, come to me and you will not be disappointed.
Outcall girls
Model
Incall girls
Hotel call girls
Female call girls service
Female
Escort service
Erotic massage
Dating
Call girls WhatsApp
Call girls number
Call girls for party
Call girls
Call girl WhatsApp
Call girl number
Call girl
Relationship
personal service
Outcall girls
Model

Shot Blaster said...

Nice Blog !...
Airo Shot Blast is the Best Shot Blasting Machine Manufacturers in India. Shot Blasting Machine price depends on size & type of shot blasting machine. we are also provide sand blasting machine, shot blasting machine, portable shot blasting machine, shot blasting cabinet, tumblast shot blasting machine, room, nozzle, shot blasting hopper, Shot Blasting Machine in Jodhpur at low price.
We are the Shot Blasting Machine Manufacturer’s in India at low price the best quality for sale. portable shot blasting machine price depends on the abrasive tank capacity and type of shot blasting machine in India.
See more :
shot blasting machine in Pune
Portable Shot Blasting Machine in India
Shot Blasting Machine Manufacturers
Shot Blasting Machine in Gurgaon
Portable Shot Blasting Machine in India
Shot Blasting Machine in Delhi

Anonim said...

toptan iç giyim tercih etmenizin sebebi kaliteyi ucuza satın alabilmektir. Ürünler yine orjinaldir ve size sorun yaşatmaz. Yine de bilinen tekstil markalarını tercih etmelisiniz.

tutku iç giyim Türkiye'nin önde gelen iç giyim markalarından birisi olmasının yanı sıra en çok satan markalardan birisidir. Ürünleri hem çok kalitelidir hem de pamuk kullanımı daha fazladır.

Digitürk sporun yıldızı paketi Faturalıya ilk 4 ay 49,00 TL, daha sonra ayda yalnızca 154,00 TL. Kredi Kartı ile 12 ay boyunca ayda 119 TL, toplamda 1428 TL.

nbb sütyen hem kaliteli hem de uygun fiyatlı sütyenler üretmektedir. Sütyene ek olarak sütyen takımı ve jartiyer gibi ürünleri de mevcuttur. Özellikle Avrupa ve Orta Doğu'da çokça tercih edilmektedir.

yeni inci sütyen kaliteyi ucuz olarak sizlere ulaştırmaktadır. Çok çeşitli sütyen varyantları mevcuttur. iç giyime damga vuran markalardan biridir ve genellikle Avrupa'da ismi sıklıkla duyulur.

iç giyim ürünlerine her zaman dikkat etmemiz gerekmektedir. Üretimde kullanılan malzemelerin kullanım oranları, kumaşın esnekliği, çekmezlik testi gibi birçok unsuru aynı anda değerlendirerek seçim yapmalıyız.

iç giyim bayanların erkeklere göre daha dikkatli oldukları bir alandır. Erkeklere göre daha özenli ve daha seçici davranırlar. Biliyorlar ki iç giyimde kullandıkları şeyler kafalarındaki ve ruhlarındaki özellikleri dışa vururlar.

tejaswani blogs said...

hey this is teju it was a fantastic article to read I loved it thanks for sharing
free social bookmrking sites list
updated social bookmarking sites list
new social bookmarking sites list 2020

jammuescortservice said...

They can guide you to remarkable places and you will have every chance to take advantage of their sexual advantage. They expect the man to be naturally horny and there is nothing to hide from her. They can be gentlemen and surprise her, but she is always ready to take action anywhere.

Agra Escorts Service |
Escorts In Mainpuri |
Escorts In Mathura |
Escorts In Meerut |
Escorts In Mirzapur |
Escorts In Moradabad |
Escorts In Muzaffarnagar |
Escorts In Noida |

poojasharma said...

Usurp the top position on search engines after availing of our Website Development Services Delhi. Webgross offers website development coming from efficient coders who incline towards user intent and satisfaction. Trust us as we prove ourselves to you through sheer hard work and determination, with availability at your service Content writing services Delhi.

jammuescortservice said...

Escorts Services in Ludhiana |
Escorts Service in Ludhiana |
Escort Services In Ludhiana |
Call Girl in Ludhiana |
Independent Call Girl In Ludhiana |
Sexy Call Girl In Ludhiana |
Hot Call Girl in Ludhiana |
Best Call Girl in Ludhiana |
Ludhiana Call Girls |

Jackets In Leather said...

Interesting post it is very helpful thanks for share it. We have an online store of leather jackets. we are offering worldwide free shipping on every order.
B3 BOMBER JACKETS
AVIATOR JACKETS
DISTRESSED LEATHER JACKETS
V BOMBER LEATHER JACKETS

Sumer said...

Nice Blog !
Shot blasting machine manufacturers of shot blasting machine in India. A Shot blasting machine is an enclosed equipment designed for abrasive blasting for cleaning and preparing rough surface.
See More :
Shot blasting machine in India

Web Plus Era said...

Thank you for this wonderful information looking forward for more Website Designing Company in Delhi

Rapid booster said...

Great job for publishing such a nice article. Your article isn’t only useful but it is additionally really informative. Thank you because you have been willing to share information with us python course in delhi

munroe island said...

The tour package for the best backwater resorts in Kerala is very much affordable, makes every visitor to count on another trip to the best resorts in Kerala.

kamagradubai said...

Excellent information Providing by your Article, Please post some more related topics. I like this post very much.
SUPER KAMAGRA IN DUBAI 100mg

Shalini said...

Thanks for the post it was very informative. Pointer Soft provides best CCTV camera installation services.

Web Plus Era said...

Great! Thanks for sharing this kind of information it’s really very nice and useful for me. Website Designing Company in South Delhi

Sand Blasting Machine said...

We are manufacturer of sand blasting machine

Sand Blasting Machine said...

The surface treatment Industry is a manufacturing company. We manufacture sand blasting machines , shot blasting machines, shot peening machine, and their equipment.

Amit Gupta said...

Posted blog really impressed me lot here I found tips and new ideas for SEO Content Writing Services India which gave helpful reasons, keep posting new informative blogs with us after all I am your regular blog reader Content writing services Delhi.

Graphic Design Institute said...

Hello, I am Arpita Sinha from Delhi
I have Read your post and found it interesting...

Thanks for sharing
Have a Great Day

Graphic design course in Delhi

Mehram said...

Hello Everyone These are Some Of My Website That I Will Rank In Google Search and Make Some
Money Online From Google AdSense So You Can Also Check These Website.
vidmate download
blog
GBWhatsapp
free fire name
YouTube Thumbnail Downloader
Tamilrockers
JPG to PDF
Hope I Will Rank it in Google as Fast as Possible. Thanks.

Aman Sharma said...

It's an impressive blog post where I have found influenced knowledge which helped me lot in my passion check for more information Blog sites thanks for providing blog post with us.

Love said...

How to Start a Blog: Easy Guide to Make $302k One Year
In this article, we will talk about how to start a blog. Seven easy steps will help you in creating your Blog. People have earned massive amounts with their blogs. They have made $1 million in a brief period.
how to create a blog, how to make a blog, How to Start a Blog, how to start writing a blog
https://www.newspostalk.com/people-choice/how-to-start-a-blog-easy-guide-to-make-302k-one-year/

Love said...

How to Make Money on YouTube: A platform that can give you high profits
Thinking about how to make money on YouTube? YouTube is no longer restricted to huge influencers or musicians. It has a good number of opportunities for everyday people.
how to earn money from youtube, how to make money on youtube
https://www.newspostalk.com/people-choice/how-to-earn-money-from-youtube/

Love said...

Newspostalk - Global News Platform
Newspostalk covers all global news & provide quality news in a various niche like Continents News, World News, Business News, Sports News, Entertainment News, Health News, technology News, Science News.
Continents News, World News, Business News, Sports News, Entertainment News, Health News, technology News, Science News
https://www.newspostalk.com/

REKHA SINGH said...

Lab Grown Diamonds on the internet at the lowest prices when compared with the other Man Made Diamonds Sellers. Unique Collection, Best Quality Guaranteed!

Josh said...

Thanks for sharing amazing information keep posting!
mangaowl

CloudInfotech said...


Get the best deals on Huawei Switches and find everything you'll need to improve your home office setup at Cloud Infotech.

All Trend Live said...

Great! Thanks for sharing this kind of information it’s really very nice and useful for me.
icici eazypay This app allows for free mobile transactions and proves to be beneficial for all retailers, dealers and professionals as this app helps them to receive instant cash payments to their customers by selecting any options available in most digital modes.
JBL Car Speakers Amazon proudly maintain one of the largest JBL – Car Speakers available. JBL has a speaker that fits almost all types of vehicles and budget. Obviously there is no place near our cheapest type of car speakers, Chinese New Year 2022Chinese New Year Celebrations Also called The Festival of Spring, in China begin with the 23rd day of twelve lunar months of the Chinese calendar. The celebration lasts approximately 23 days, and it ends at the end of first lunar month following the year according to the Chinese calendar.

Unknown said...

복수자카지노 - 【카지노사이트】바카라사이트,파라오카지노,샌즈카지노,SM카지노

DIGITAL MARKETING said...

Thanks for posting, it is really helpful. We are a leading Digital Marketing & Web Designing Company in Delhi. Visit us.
Digital Marketing comapany in Delhi
Web Designing comapany in Delhi

Academyofappliedarts said...

This article is very Interesting information Thanks for Sharing. Are you looking for Top Interior Designing Institute in Delhi | Interior Designing Course Fees Delhi

Web Plus Era Team said...

Thanks for this. I really like what you've posted here and wish you the best of luck with this blog and thanks for sharing. Website Designing Company in Delhi

Sadhana Singh said...

I like this post. I needed a post like this and I’m impressed Thank you for sharing this.

https://jeetechacademy.com/web-development-course/

Kickr Technology said...

Kickr Technology's development team help us deliver beautiful, innovative software applications and mobile apps that simplify various business processes. We offer optimal solutions that work with your team to augment your capabilities and simplify the development process.

Vardhaman Dental Hospital said...

Thank you for sharing this article please visit here Full Mouth Dental Implant in Jaipur
Laser Dentistry In Jaipur
Smile Makeover in Jaipur
Invisiable Brace in Jaipur
Teeth Whitening in Jaipur

Digital Marketing Services In Delhi said...

Best Digital Marketing Serices-Best SEO Optimization Services Provide We are provide SEO Optimization Services to Client Website Increase costumer to give Best Facility https://thebravemedia.com .

Promote Abhi said...

I am running Responsive Website Designing Company in Delhi and Top Digital Marketing Agencies in Delhi. That blog will help me for promote my website.

Kickr Technology said...

Your post is good. Thank you for sharing! Mobile App Development Company

lishasingh said...

Escape the daily grind and relax your mind, body and soul at Whether you're a dedicated worker or an overworked student, our expert massage therapists are here to relieve tension in tense muscles with their b2b spa massage in bangalore ultimate skill set of skills!

lipikabri said...

The staff with Body to Body Massage in hyderabad offer all modern amenities at our center to help you relax and at ease. The atmosphere is awe-inspiring due to the pleasant scent of incense and the peacefulnes b2b spa massage in hyderabads that you'll experience at our center located in hyderabad.

spa69 said...

Safe and secure massage spa Bangalore, for female also therapies are there Indian Ayurveda massage to reduce stress. Thai massages for full body stretching. Book Now Visit b2b massage in bangalore

isha spa said...

massage is a great way to relieve muscle pain, soreness, and tension. It doesn’t matter whether this pain was caused by physical or mental stress, the massage will work it out for you.

Visit Body to Body spa near me

Divya Agarwal said...

It is a nice post to keep sharing valuable information like this. Graphic design courses fees in delhi

Acelema It Solutions said...

thank you for sharing this information with us.

Web Designing Company in Delhi


muraqabah said...

Good Job...!
The Gaia Hotel Bandung
Rekomendasi hotel Danau Toba
Cheap flight ticket

We are a company engaged in the field of tour and travel, as a means and infrastructure for industry
travel and tourism. The best travel agency provides tourist bus rental, car rental and selling plane tickets
in Medan.

lipikabri said...

Pressure point massage is a treatment that applies body massage spa near me pressure to specific points on the feet. These points correspond to all organs, glands and tissues in your body. It promotes relaxation, increases energy, and balances the body. The foot massage chair allows the recipient to relax and sit comfortably on it.

Roofing Sheet Manufactures in India said...

I read you blog and it was mind blowing. I write a blog on Color Coated Steel Roofing Sheet Manufactures

leenamonica said...

We have the perfect spa day for you if you want a relaxing spa experience in a tranquil environment with dimly lit aromatherapy
body massage in bangalore candles and soothing music.

leenamonica said...

The spas are designed to help you relax and B2B massage unwind.codella is a well-known Spa in Koramangala. We provides best spa services in Bangalore. 

Jacob Warner said...

Great, your blog was very nice. Thanks for sharing it if anyone wants Research Writing freelancer then Paperub is a platform where you get a skilled freelancer according to your requirement. Visit Paperub to get a freelancer in minutes.

Unknown said...

web designing course

web development course

digital marketing course

full stack development course

Appic Software said...

A very informative blog that almost solved all my doubts. I would like to appreciate the efforts put in by you to write it and help the readers. However, if you are looking a mobile app development company, then you should check Appic Softwares, visit our website at Automotive Mobile App Development.

nancysweety said...

The ayurvedic practitioner is therefore looking to
balance the body and mind, to ferret B2B spa in pune out health problems before they happen or to nip
them in the bud before they do any real harm.

Ambika Kuntal said...

Looking for the Best Custom Home Builders in Melbourne, Australia? Our expert team will work with you to create the perfect home that meets your unique needs and style preferences.

«Oldest ‹Older   201 – 315 of 315   Newer› Newest»