Tuesday, June 16, 2015

Dude, where’s my heap?

Or: Bypassing High-Entropy Bottom-Up Randomization in Windows 8 by abusing IE’s Memory Protection


Note: This is a copy of a blog post that was originally published on the Google Project Zero blog.

The ability to place controlled content to a predictable location in memory can be an important primitive in exploitation of memory corruption vulnerabilities. A technique that is commonly used to this end in browser exploitation is heap spraying: By allocating a large amount of memory an attacker ensures that some of the allocations happen in a predictable memory region. In order to break this technique, in Windows 8 Microsoft introduced High Entropy Bottom-Up Randomization. Essentially, it introduces 1TB of variance in start address of heap (as well as stack and other allocations) in 64-bit processes. In a traditional heap spraying scenario, this would mean that the attacker needs to allocate over 1TB of memory in order to place content at a predictable location which is infeasible on today’s computers. Internet Explorer 11 (as well as various other 64-bit processes on Windows 8) employs this mitigation whenever it uses a 64-bit tab process (such as in Metro mode or with Enhanced Protected Mode turned on).


Internet Explorer also introduced another mitigation called MemoryProtector in order to prevent exploitability of use-after-free vulnerabilities. The two mitigations are not meant to be related. However, somewhat unexpectedly, one can be (ab)used to bypass the other. In one sentence, it is possible to use a timing attack on MemoryProtector to reveal the offset used by High-Entropy Bottom-Up Randomization, thus completely bypassing it.

The Issue


MemoryProtector is intended to prevent exploitation of a certain kind of use-after-free vulnerabilities. Since details of the mitigation have already been published in various places (such as here), only the bare essentials sufficient to understand the issue will be given here. Simplified, MemoryProtector prevents exploitability of use-after-free vulnerabilities in which a pointer to a freed object is kept on the stack. This is a common situation in web browsers caused by the code such as

Node* node = getNodeFromSomewhere();
fireJavaScriptCallback(); // kills node
node->DoSomething();

In the example above, a pointer to the Node object is obtained and stored in a local variable (on stack). After that, a function is called which ends up causing JavaScript callback. Attacker-controlled code in the JavaScript callback causes node to be deleted, but after the control flow returns to the code above, the node is referenced after being deleted (use-after-free condition).

MemoryProtector works by preventing the object (Node in the example above) from being freed if its address can be found on the stack (in the node variable in the example above). If MemoryProtector is enabled, for certain classes, deleting won’t free the memory right away - it will only zero it out. Once the size of those freed-but-not-really objects reaches a certain threshold, MemoryProtector will scan the stack and identify which of these objects have their addresses on the stack. Those that do not will be deleted. The others are left untouched and will be considered again during the next stack scan. Thus it is ensured that no object gets freed while its address is on the stack.

To demonstrate the issue that enables us to defeat High-Entropy Bottom-Up Randomization several observations need to be made. The first observation is that, when scanning the stack, MemoryProtector cannot differentiate between addresses and other types of data on the stack. Thus, it will treat all data on the stack (such as, for example, user-controlled double-precision numbers or 64-bit integers) as addresses. Since some of this data can be attacker-controlled, an attacker can deliberately place something that looks like an address on the stack and prevent an object located at that address from being freed. In fact, an attacker might be able to place multiple addresses on the stack and prevent freeing of objects at any of those addresses. By itself this isn’t very dangerous - it can cause memory exhaustion and not much else.

The second observation to make is that freeing memory takes time, especially for large (such as 1MB used by the PoC) objects where free/delete ends up calling VirtualFree. The time is sufficiently large to observe a difference between the time it takes to free a large object and attempting to delete an object without actually freeing it (which happens with MemoryProtector) if the address of the object is present on the stack during the delete attempt.

This is demonstrated in Figure 1. Notice that for memory range [0x9ddc000000, 0x9de0000000] the time it takes for MemoryProtector to run is much less than for other ranges because the block doesn’t get freed during the run. Also notice that the next run takes longer than average. This is because during this run two blocks are freed (one from the current run and one from the previous one).

Figure 1.

Thus by spraying the stack with a range of possible addresses and then triggering a free and measuring the time it takes to free (or not) the object, it is possible to determine if the object was allocated in the given address range or not. If an address of the object is detected, the attacker will also learn the approximate offset used by High Entropy Bottom-Up Randomization and will be able to predict addresses used by future (or past) allocations.

Description of the Exploit


There are several hoops to jump through in order to exploit the issue. The first one is placing controllable data on the stack. Standard stack spraying techniques such as using a JavaScript function with a lot of local variables or calling a JavaScript function with a lot of arguments don’t actually work because JavaScript variables in IE are stored in a packed format which makes it difficult to have a variable whose representation could also be mistaken for an address (that is, different than the address of a variable itself). However, I have observed that during some numeric computations, such as multiplication, JavaScript engine will place intermediate results in a native double format on the stack. It is trivial to create double-precision numbers that will look like addresses in the required range (0x0000000000 to 0x10000000000).

The second issue is reducing the search space because we don’t want to have to try out all addresses in the lower 1TB range. Since we will be using a large allocation (allocated using VirtualAlloc) it is known that the allocation will be made on 0x1000 boundary (in Windows 8). Thus there are ‘only’ 0x10000000 possibilities. Note also that for each experiment we can place multiple values on the stack at once. The current PoC can test 0x4000 possibilities in one experiment, thus also reducing the number of required experiments to 0x4000 (16K). If each experiment allocates 1M of memory, this means that all experiments allocate a total of 16GB of memory throughout a single PoC run. However note that these allocations are not needed at the same time, in fact only two 1M allocations are needed at any given time plus some stack space and other smaller heap allocation made by the PoC. Thus the PoC should run fine even on machines with very low amount of free RAM.

The next issue is triggering MemoryProtector at the desired time. By looking at the code of MemoryProtection::CMemoryProtector::ReclaimMemory() function, it is easily determined that MemoryProtector triggers after more than 100000 bytes of memory is freed. This is fine because we’ll use an allocation larger than that anyway. In the PoC, MemoryProtector is triggered by first setting the ‘title’ property of a Button HTML element to a large (1MB) string and then to a small string. If the address of a large string is not found on a stack when MemoryProtector is triggered, it will get freed. Otherwise, it will get freed next time MemoryProtector runs if the allocation address is no longer on the stack.

We also need a way to measure time precisely since the times involved will be in sub-millisecond intervals. Fortunately, we can use performance.now() API which is supported in Internet Explorer for this.

The full PoC can be found here.

Reproducing the Issue


To reproduce the issue you first need to ensure that IE runs tab process in 64-bit mode. There are several ways to accomplish this. Probably the easiest is to open the PoC in IE in Metro mode where 64-bit tab process is used by default. In desktop mode 64-bit is still not the default (though presumably this will change at some point in the future). But you can have 64-bit tab processes in desktop mode as well either by making IE run in a single process mode or enabling Enhanced Protected Mode.

You can make IE run in a single process mode by setting TabProcGrowth registry key to 0, however note that this should never be used when browsing untrusted websites and opening untrusted files as it disables the IE sandbox.

The recommended way to run IE in 64-bit mode is to enable Enhanced Protected Mode,  which can be done by changing Internet Options -> Advanced -> Security -> ‘Enable Enhanced Protected Mode’ and ‘Enable 64-bit processes for Enhanced Protected Mode’. Not only will this enable additional mitigations that can be found on 64-bit Windows but will also enable additional sandboxing features, so I fully recommend that users run IE like this.

Note however, that when Enhanced Protected Mode is enabled, you’ll need to open the PoC in the Internet Zone because Enhanced Protected Mode does not get applied to Local intranet and Trusted sites (including local files). If successful, you should see processes like this when opening the PoC.

Figure 2.

Note: It’s also possible to run the PoC in 32-bit mode with some changes. You need to replace the line ‘o.cur = min + 0x40;’ with ‘o.cur = min + 0x20;’ and the line ‘var max = 0x10000000000;’ with ‘var max = 0x100000000;’. However note that High Entropy Bottom-Up Randomization doesn’t get applied to 32-bit processes so all allocations should (predictably) happen in a low memory range.

After you have the test environment set up, just click “Dude, where’s my heap?” button on the PoC and wait. The entire run of the PoC takes about 30 seconds on a reasonably modern computer.

After the test run finishes, you should see the detected allocation memory range as well as detailed output of memory ranges sorted by time it took to run the experiment. By opening IE process in your favorite debugger you should be able to verify that memory allocations do indeed happen in the detected range. This is demonstrated in Figure 3.

Figure 3.

The PoC currently uses a very simple heuristics to detect if the run was successful - there needs to be a single memory range for which the run time is faster than for all other runs by at least a threshold %. Note that this PoC is made just for demonstration purposes and there are likely ways to make the poc both faster and more reliable. It could be made more reliable for example by repeating the experiments for the small number of best candidates (and possibly adjacent ranges) to verify the result or repeating the entire run if the result can’t be verified. It could also be made faster by breaking early if a good candidate is found in one of the experiments (expected to reduce the run time by half on average), by finding a way to put more user-controlled data on the stack or possibly by incorporating some other insight about the entropy of bottom-up randomization.

Vendor response


The issue was reported to Microsoft on January 19th in the context of the Mitigation Bypass Bounty program. The initial response (on January 28th) was that the “submission meets Microsoft’s criteria for the Mitigation Bypass” and “has novel elements”. On April 23rd (~3 months later) I was notified that “investigation determined the effort involved to ship a fix, that enabled MemoryProtect to not allow ASLR bypass down level, would be a significant amount of resources (and possible regression risk) for an issue primarily applicable to a non-default configuration” and Microsoft “will explore ways to mitigate this problem in the next version of our product”. MSRC noted this decision was based on the facts that “64-bit IE is a non-default configuration” and “MemoryProtect has led to a significant overall decrease of IE case submissions”. Thus the issue is still unfixed.

Potential collision with HP Security Research


On February 5th (2 weeks after I sent my report to Microsoft) HP Security Research announced that they also received a Mitigation Bypass bounty from Microsoft. In addition to other attacks they mention that “attacker can use MemoryProtection as an oracle to completely bypass ASLR” which leads me to believe that there is a partial (but not complete, judging by the Microsoft response) overlap between our research.

The details of HP’s research are unknown at this time but if I had to guess, I’d say they were using the same basic principle to map the free memory of a 32-bit process. By finding which memory regions are already allocated (addresses where the attacker can’t allocate memory on) it might be possible, based on the allocation address and size, to tell which of these allocations were made by executable modules.

Conclusion


Both High-Entropy Bottom-Up Randomization and MemoryProtector are really useful mitigations. Without MemoryProtector or in scenarios where the attacker does not have the same amount of control as in a web browser, High-Entropy Bottom-Up Randomization is an efficient defense against heap spraying and similar techniques. Similarly MemoryProtector is an efficient defense for use-after-free vulnerabilities where the object reference is kept on the stack. While it might be possible to bypass it in specific scenarios, it renders a large number of vulnerabilities unexploitable.

It is only when these mitigations come together in an environment with a lot of control given to the attacker, including control over the stack and heap allocation as well as the ability to accurately measure time, that the problem manifests. For what it is worth I agree that fixing the issue would be very difficult without making serious compromises because it basically exploits how the mitigations in question work as intended. Microsoft has a tough job if they indeed want to fix this issue in the future.

As new mitigations grow both in number and complexity this might not be the last time we see them interacting in unexpected ways.

112 comments:

Unknown said...


Thank you for taking the time to provide us this valuable information. we appreciate you for this valuable information
Informatica Training in Chennai Thiruvanmiyur

Maani kamili said...


I simply couldn’t depart your site before suggesting that I really enjoyed the usual information an individual supply in your visitors? Is going to be again steadily to check out new posts.

Web development company in Chennai

aliyaa said...

Your blog provided us with valuable information to work with. Each & every tip of your post is awesome. wordpress support services

Hammed said...

I just see the post i am so happy to the communication science post of information's.So I have really enjoyed and reading your blogs for these posts.Any way I’ll be replay for your great thinks and I hope you post again soon....


SEO Company in Chennai

Unknown said...

Wonderful blog.. Thanks for sharing informative blog.. its very useful to me.. iOS App Development Company in India

Unknown said...

This post is really nice and informative. The explanation given is really comprehensive and informative...
Security alarm in Chennai

Akshaysri said...

This is an awesome post.Really very informative and creative contents. These concept is a good way to enhance the knowledge.I like it and help me to development very well.Thank you for this brief explanation and very nice information.Well, got a good knowledge.
Australia Education Consultants in Chennai

Unknown said...

Very nice post here thanks for it .I always like and such a super contents of these post.Excellent and very cool idea and great content of different kinds of the valuable information's.

Fresher Jobs in Chennai
Fresher Jobs in Delhi
Fresher Jobs in Bangalore
Fresher Jobs in Kolkata

Prasanth said...

Good work…unique site and interesting too… keep it up…looking forward for more updates. It is very informative on subject or topic.
UI UX Design Companies in Bangalore, Web Application Development in Bangalore

kumar said...

Firstly I want to say thanks for the useful information that you are giving here on this post. Every time I come to this site, I always walk away with a lot of new knowledge.
Engineering Colleges, Mechanical Engineering Colleges in Chennai

Anonymouse said...

The exercises which they don't have any know how and this will make them a hazardous people for the general society. Training makes an ignorant individual more ready to teach themselves.wordpress survey plugin

Unknown said...

cute blog with colourful images, really I appreciate your works. All the articles are very interesting to read
Ear plugs for Sleeping
Musicians Earplugs
Motorcycle Ear Plugs
Ear Plugs for Swimming
Custom Ear Plugs

Unknown said...

Nice article you have been posted, It's very informative and helpful. Thanks for sharing it.internet security

Avantika joy said...

Thanks for appreciating. Really means and inspires a lot to hear from you guys.I have bookmarked it and I am looking forward to reading new articles. Keep up the good work..Believe me, This is very helpful for me.
Pimple Treatment
Pigmentation Cream
Acne Cream

Mrs Sharon Sim said...

Hello Everybody,
My name is Mrs Sharon Sim. I live in Singapore and i am a happy woman today? and i told my self that any lender that rescue my family from our poor situation, i will refer any person that is looking for loan to him, he gave me happiness to me and my family, i was in need of a loan of S$250,000.00 to start my life all over as i am a single mother with 3 kids I met this honest and GOD fearing man loan lender that help me with a loan of S$250,000.00 SG. Dollar, he is a GOD fearing man, if you are in need of loan and you will pay back the loan please contact him tell him that is Mrs Sharon, that refer you to him. contact Dr Purva Pius,via email:(urgentloan22@gmail.com) Thank you.

URGENT LOAN said...

Hello Everybody,
My name is Mrs Sharon Sim. I live in Singapore and i am a happy woman today? and i told my self that any lender that rescue my family from our poor situation, i will refer any person that is looking for loan to him, he gave me happiness to me and my family, i was in need of a loan of S$250,000.00 to start my life all over as i am a single mother with 3 kids I met this honest and GOD fearing man loan lender that help me with a loan of S$250,000.00 SG. Dollar, he is a GOD fearing man, if you are in need of loan and you will pay back the loan please contact him tell him that is Mrs Sharon, that refer you to him. contact Dr Purva Pius,via email:(urgentloan22@gmail.com) Thank you.

rohanrj said...

I truly appreciate this post.The design of the home is very beautiful. I am very lucky to be able to come to see your weblog.Keep up the good work. fire watch

Ancy merina said...
This comment has been removed by the author.
Karqa said...

Thank you very much for your good blog
Bedava Sohbet Et
Sohbet Et
Chat yap
Sohbet
Sohbet Siteleri
irc sohbet
mirc Sohbet
Üyeliksiz Sohbet
Canlı Sohbet
Sohbet
Sohbet Chat
Sohbet Siteleri
Sohbet Odalari
Seviyeli sohbet
Yazışma Siteleri
Yetişkin sohbet Siteleri

ciitnoida said...

It was excellent and really informative.I also like composing something if my downtime. So I could find out something from your write-up. Thanks.

Best BCA Colleges in Noida

Unknown said...

Thanks for sharing these information. It’s a very nice topic. We are providing online training classes

Best Cartoon Picture Apps
Best Caller ID Apps
Fighting Games for Android
Call Recorder Apps

Sania khan said...

This blog was... how do you say it? Relevant!! Finally I've found something which helped me. Cheers! sad poetry about love

Usman Abbaxi said...

Good work…unique site and interesting too… keep it up…looking forward for more updates.

liza said...


Thanks for sharing the information. It is very useful for my future. keep sharing
visit our web

basha said...

Superb blog I visit this blog it's really awesome. The important thing is that in this blog content written clearly and understandable. The content of information is very informative.
Oracle Fusion HCM Online Training
Oracle Fusion SCM Online Training
Oracle Fusion Financials Online Training
Big Data and Hadoop Training In Hyderabad
oracle fusion financials classroom training
Workday HCM Online Training
Oracle Fusion HCM Classroom Training
Workday HCM Online Training

Anonymous said...

Its a wonderful post and very helpful, thanks for all this information. You are including better information regarding this topic in an effective way.Thank you so much

QlikSense Online Training


Oracle Sql Plsql Online Training


Arcsight ESM Online Training

Perfect Strom said...

Türkiye'nin yıllardır en çok ziyaret edilen hava yolu uçak kargo şirketi sizlerle.


uçak kargo
kargo
uçak kargo
yurtdışı kargo
uçak kargo
yurtdışı kargo
thy kargo
hava kargo
yurtdışı kargo

Selin Yalın said...

geveze

chat odaları

türk chat

sohbet

kelebek sohbet

kızlarla sohbet

bayanlarla sohbet

vinith said...

You actually make it look so easy with your performance but I find this matter to be actually something which I think I would never comprehend. It seems too complicated and extremely broad for me. I'm looking forward for your next post, I’ll try to get the hang of it!

python training in bangalore

rithiaanandh said...

Very nice post here and thanks for it. I always like and such super content of these post. Excellent and very cool idea and great content of different kinds of valuable information's.
Sql server dba online training

Shadeep Shree said...


I would definitely thank the admin of this blog for sharing this information with us. Waiting for more updates from this blog admin.
Data Science Course in Chennai
Data Science Training in Chennai
AWS Training in Chennai
Azure Training in Chennai
Cloud Computing Training in Chennai
VMware Training in Chennai
Data Science Training in Velachery
Data Science Training in Tambaram
Data Science Training in Adyar

kirankumar said...

Thanks for posting the information it is useful and helpful
Sanjary Academy is the best Piping Design institute in Hyderabad, Telangana. It is the best Piping design Course in India and we have offer professional Engineering Courses like Piping design Course, QA/QC Course, document controller course, Pressure Vessel Design Course, Welding Inspector Course, Quality Management Course and Safety Officer Course.
Piping Design Course

shemadevan said...

Nice Blog..Waiting for next upddate...
Drupal Training in Chennai
Drupal 8 Training
Drupal Classes
Drupal Training in Velachery
Drupal Training in Tambaram
Photoshop Classes in Chennai
clinical sas training in chennai
SAS Training in Chennai
javascript training in chennai
Hibernate Training in Chennai

impressbss said...

You shared a lot of information
web designing company in chennai

Savanah Eden said...

thanks for ur valuable information,keep going touch with us

Aluminium Scaffolding dealers in chennai

Destiny Solutions LLP said...

shipstation quickbooks integration

Merry said...

Read this article
Read this article
Read this article
Read this article
Read this article
Read this article
Read this article
Read this article
Read this article
Read this article

kameralı sohbet said...

Sohbet

Tashi said...

Grow sale India ads available in India of goods for sale from cars, furniture, electronics to jobs and services listings.

post free classified ads in india

Ram Niwas said...
This comment has been removed by the author.
wood couter said...

Thanks for posting useful information.You have provided an nice article, Thank you very much for this one. And i hope this will be useful for many people.. and i am waiting for your next post keep on updating these kinds of knowledgeable things...Really it was an awesome article...very interesting to read..please sharing like this information......
outdoor game

Unknown said...

I am expecting more interesting topics from you. And this was nice content and definitely it will be useful for many people. outdoor game

News 24 said...

This is excellent information. It is amazing and wonderful to visit your site.Thanks for sharng this information,this is useful to me... outdoor game

repairtechsolutions said...

I enjoy reading a post online google pixel display repair that can make men and women think. Also, thanks for permitting online nokia display repair me to comment! Right here is the right web site for anyone who wishes to understand this online iphone display repair topic.

repairtechsolutions said...

You understand so much it's almost online mi display repair hard to argue with you (not that I actually would want to…HaHa). You definitely put a fresh spin online lg display repair on a topic that's been written about for decades. Wonderful stuff, just excellent! Aw, this was an incredibly online mobile repair marathahalli good post. Spending some time and actual effort to produce a very good article…

Lavandep Smith said...

Get Support for:

Ledger Wallet Support
Ledger Wallet Customer Support Number
Trezor Support
Trezor Customer Support Number
Electrum Wallet Support
Electrum Wallet Customer Support Number

Ledger Nano S wallet Not Updating
My Ledger Stoped working Need Support
How to Use Ethereum First Time

KolaySohbet said...

thank you web admin very good sohbet içerik.

kartal evden eve nakliyat said...

Nice Servis
Nice Servis
Nice Yetkili Servis

kameralisohbet, said...

kamerali sohbet
kamerali chat
kamerali sohbet 18
kamerali
mobil sohbet
sohbet
mobil chat
mobil sesli sohbet
omegle sohbet
görüntülü sohbet

Jones Brianna said...

Hey, You have written an impressive blog post, Your stuff is full of knowledge. Thank you so much for sharing this unique and impressive stuff.
Fantasy Sports App Development

Naveen said...

Here is the details of best BSc Medical Imaging Technology Colleges in Bangalore. You can get the college details from the below link. BSc Medical Imaging Technology Course is one of the best demanding course in recent times in India
BSc Medical Imaging Technology Colleges In Bangalore

Naveen said...

Christian College Bangalore providing BSc Optometry Course. Here is the link about the details of BSc Optometry. You can click the below link for more information about BSc Optometry. BSc Optometry is one of the most demanding course in recent times.
Optometry Colleges In Bangalore

Naveen said...

GrueBleen is one of the Branding and Marketing agency Based in Riyadh- Saudi Arabia. The main functions of GrueBleen is Advertising, Branding, Marketing, Office Branding, Exhibition Management and Digital Marketing. Visit the below link to know more about GrueBleen Creative Club.
Branding Agency Riyadh
Marketing Agency Riyadh

Naveen said...

BSc Perfusion Technology – If you are looking to study BSc Perfusion Technology in Bangalore, just check out the following link. In that link you can get the details of Best BSc Medical Imaging Technology colleges in Bangalore
BSc Perfusion Technology Colleges in Bangalore

Sudharshan said...

Great blog !It is best institute.Top Training institute In chennai
http://chennaitraining.in/openspan-training-in-chennai/
http://chennaitraining.in/uipath-training-in-chennai/
http://chennaitraining.in/automation-anywhere-training-in-chennai/
http://chennaitraining.in/microsoft-azure-training-in-chennai/
http://chennaitraining.in/workday-training-in-chennai/
http://chennaitraining.in/vmware-training-in-chennai/

Sudharshan said...

Thank you for taking the time to provide us with your valuable information. We strive to provide our candidates with excellent care
http://chennaitraining.in/creo-training-in-chennai/
http://chennaitraining.in/building-estimation-and-costing-training-in-chennai/
http://chennaitraining.in/machine-learning-training-in-chennai/
http://chennaitraining.in/data-science-training-in-chennai/
http://chennaitraining.in/rpa-training-in-chennai/
http://chennaitraining.in/blueprism-training-in-chennai/

Mobzway said...

Awesome blog. I enjoyed reading your articles. This is truly a great read for me. I have bookmarked it and I am looking forward to reading new articles. Keep up the good work. Visit: Poker Game Development Company

güncel moda said...

sohbet
https://www.sevgisohbet.com/

SSK Law Firm said...
This comment has been removed by the author.
SSK Law Firm said...

Awesome blog. I enjoyed reading your articles. This is truly a great read for me. I have bookmarked it and I am looking forward to reading new articles. Keep up the good work

'Domestic Violence Alimony Lawyers in Chennai
Property Registration Lawyers in Chennai
Property Legal Lawyers in Chennai
Document Registration Lawyers in Chennai
Construction Issues Illegal Possession Lawyers in Chennai
Consumer Lawyers in Chennai
Consumer Fraud Lawyers in Chennai
Property Fraud Lawyers in Chennai'

SSK Law Firm said...

It is actually a great and helpful piece of information about Java. I am satisfied that you simply shared this helpful information with us. Please stay us informed like this. Thanks for sharing.

'SSK Law Firm'

CCC Service said...

Enjoyed reading the article above, really explains everything in detail, the article is very interesting and effective. Thank you and good luck…
'CCC Service
AC Service in Chennai
Fridge Service in Chennai
Washing Machine Service in Chennai
LED LCD TV Service in Chennai
Microwave Oven Service in Chennai'

ReSt said...

Mobil Chat Sınırsız sohbet ve chat dünyasına hoş geldin! Türkiye'nin en ünlü gevezelerini bir çatı altında topladık. Eğer söyleyecek bir sözün varsa ve gevezelik yapacak yer arıyorsan hemen içeri gir. Sohbet odalarında oyun, eğlence ve
Mobil Sohbet
müzik keyfi seni bekliyor. Günün ilk ışıklarına kadar
Sohbet
süren muhabbet ve şamata dünyasında takma bir nick kullanarak hemen yerini al.

Unknown said...

Thanks for sharing amazing information.Gain the knowledge and hands-on experience.
Oneyes Technologies
Inplant Training in Chennai
Inplant Training in Chennai for CSE IT MCA
Inplant Training in Chennai ECE EEE EIE

ravi said...

Thanks for provide great informatic and looking beautiful blog, really nice required information & the things i never imagined and i would request, wright more blog and blog post like that for us. Thanks you once agian

name change procedure in ghaziabad
name change procedure delhi
name change procedure gurgaon
name change in faridabad
name change in noida
name change
name change in india
name change procedure in bangalore
name change procedure in rajasthan
name change procedure in maharashtra

Prime AdventureTours said...

What an article. it is a good read though.I must appreciate you for providing such a valuable content for us i have bookmarked this site for further information ,you are doing a great Job thanks and keep posting you can visit us for
taxi hire in jaipur

Prime AdventureTours said...

What an article. it is a good read though.I must appreciate you for providing such a valuable content for us i have bookmarked this site for further information ,you are doing a great Job thanks and keep posting you can visit us for
jaipur sightseeing package

sara mohamed said...

شركة تنظيف خزانات بحائل
شركة تنظيف مساجد بحائل
شركة تنظيف مجالس بحائل
شركة تنظيف كنب بحائل
شركة تنظيف بحائل
شركة تنظيف فرش بحائل
https://clean4hail.com



Anonymous said...
This comment has been removed by the author.
Civil Service Aspirants said...

Really i found this article more informative, thanks for sharing this article! Also Check here
Civil Service Aspirants
TNPSC Tutorial in English
TNPSC Tutorial in Tamil
TNPSC Notes in English
TNPSC Materials in English
tnpsc group 1 study materials

PlanA said...

Great narration ! Really interesting .Keep updating Thanks for share

GMAT classes chennai

Anonymous said...

Nice blog thank you for sharing
Python Interview Question And Answers
Web Api Interview Questions
OSPF Interview Questions And Answers

Unknown said...

Organic Chemistry tutor
hadoop training in chennai
Drilling consultants
Online drilling consultancy

Sunder said...

Great Content & Thanks For Shaaring. But Do You Know Which Is Top 10 Digital Marketing Company In Dehradun

freyr energy said...

Thank you for this information. Freyr Energy was founded on the principles of making solar energy affordable and accessible for everyone. In order to make adoption of solar energy a reality at the grass-root level, we have identified that consumer awareness, affordability and accessibility play an integral role. With our innovative platform, SunPro+, our extensive channel-partner network and our efficient service we ensure that these three factors are addressed to make sure your venture into solar energy is hassle-free. Best solar company in Hyderabad-freyr

ygoseo said...

Different between SEO and ASO by Ygoseo.
What is App Store Optimization (ASO)
App store optimization is the process of optimizing mobile apps to rank higher in an app store’s search results. The higher your app ranks in an app store’s search results, the more visible it is to potential customers.

That the Ygoseo is increased visibility tends to translate into more traffic to your app’s page in the app store.

What is going into SEO
To recognize the actual that means of SEO, let's smash that definition down and have a take a observe the parts:
Quality of site visitors. You can appeal to all of the site visitors with inside the world, however, if they are coming in your web website online due to the fact Google tells them you are an aid for Apple computer systems whilst sincerely you are a farmer promoting apples, that isn't always pleasant site visitors. Instead, you need to draw site visitors who're surely inquisitive about the merchandise which you offer. Quantity of site visitors. Once you've got got the proper humans clicking thru from the ones seek engine outcomes pages (SERPs), greater site visitors is better.Organic outcomes. Ads make up a big part of many SERPs. Organic site visitors is any site visitors that you do not ought to pay for.

both are different are SEO and ASO By Ygoseo
For more information about it visit our
website https://ygoseo.com/
email= info@ygoseo.com

TechGuru said...

Web Hosting Tech Guru Host Domain Name EMail Marketing By techguru
TechGuru Host Has Everything you need to build your own business
in one place - Web Hosting, Domain Name,snd Much More At an Affordable
Price and We provide quick, secure, and safe cloud hosting for websites
For more detail visit
https://www.techguru.host/
Address : Konark Darshan B, PN-53, Zaver Rd, Mulund West, Mumbai, Maharashtra 400080
+91 9768686898 , 91 9867660596
support@techguru.host
sales@techguru.host

Harika said...

Our MicroStrategy Training provide you to learn about MicroStrategy products, BI concepts, etc. Our MicroStrategy Online Training also includes live sessions and projects
learn microstrategy online | Microstrategy Online Training Hyderabad

Emily Green said...

Hey! Excellent work. Being a QuickBooks user, if you are struggling with any issue, then dial QuickBooks Customer Service Our team at QuickBooks will provide you with the best technical solutions for QuickBooks problems.

https://chatrulet.de said...

chat rulet
omegla
şirine
omegla
ometv
ometv
ome tv
gabile
mobil sohbet
chat rulet

https://ometv.de said...

chat rulet|şirine|omegla|ometv|chat rulet|ome tv|ome tv|ome tv|chat rulet

Anonymous said...

Excellent blog thanks for sharing with us.
You can also check python training in Bangalore

Sohbet said...

sohbet,mobil chat,mobil sohbet kaliteli mobil Sohbet odaları online muhabbet siteleri

Remote said...

Sohbet

chat

sohbet odaları

chat odaları

eFe said...

dini sohbet

islami sohbet

dini sohbet odalari

dini chat

islami chat

dini sohbet

islami sohbet

dini chat

islami chat

dini sohbet

dini sohbet odalari

dini chat

islami sohbet


dini sohbet

dini sohbet odalari
dini chat

islami sohbet
sohbet odaları
sohbet
dini sohbet

islami sohbet

dini chat

islami chat

dini sohbet

islami sohbet

dini chat

islami chat

Sohbet said...

https://sohbetislam.com islami sohbet dini chat

samantha said...

Token Development Company
Cryptocurrency Exchange Software Development Company
White label Crypto Exchange Software Development Company

alexa jone said...

Good content with great information keep it up . kinndly please visit our
quickbooks phone number for resolve any query

Sohbet said...

Thank you good blog live chat room
Sohbet
Sohbet Odaları

acemimemet said...

Thank you very much this is a sites very beaitiful

islami sohbet
dini chat

Oarraziq said...


Hitfilm pro keyegn
good post

keygenius.net/ said...

abelssoftclick this

Crackcon said...

The whole user interface (title bars, push buttons, start menu, taskbar, etc.) gets updated with new visual styles.
These skins are called themes.
This gives users complete control over the appearance of Windows.
windowsloader


serial said...

I’m glad that you just shared this helpful info with us. Please keep us informed like this
Sidifi Music Converter

kajal shah said...

The information you shared is very helpful I'm glad to read it

divorce lawyers in chennai

Unknown said...


MKVToolnix Crack is an amazing Post with good content.FIND CRACK is the best crack software site for all Mac and Windows users all over the world.

Unknown said...

I enjoyed reading your blogs great work done.

overseas education consultants in hyderabad

softskey said...


This is very interesting blog. A lot of article I read nowadays don't really offer anything that I'm enthusiastic about, but I'm most certainly hooked about this one.

Nitlimiter crack

softskey said...


Thank you for reading,
I hope this post was useful to you.
I appreciate you sharing such an informative and interesting post.
IDM Crack

https://wares4pc.com/ said...

Open the terminal and type the following command to check disk space.
nch mixpad masters crack

kajal shah said...

Incredible work good content and good blogs.

ceramic coating in chennai

oktay said...

üye olmadan kaliteli sohbet ve Cinsel Sohbet güzel arkadaşlıklar kurabilirsiniz.

kajal shah said...

I'm glad that I found this page very informative thank you for sharing them.

Buy Home Theatre Systems In Chennai

Tarzsohbet said...

sohbet odaları
chat odaları
mobil sohbet
canlı sohbet
sesli sohbet
tr sohbet
sohbet
sohbet
koyu sohbet
sohbet

fernelisabeth said...

Excellent Blog.
Decentraland Clone Script |
OpenSea Clone Script |
Foundation Clone Script |
NFT Minting Platform Development Company |
Solana NFT Marketplace Development Company |
NFT Music Platform Development Company |
NFT Art Marketplace Development Company |

FuelDigi Marketing Pvt Ltd said...

This is very interesting, you are a skilled blogger. I have added your feed and hope to keep looking for more FDM is one of the
Best Android App Development Company Services in Chennai
. For More Details Contact us: 91+ 9791811111 or visit our website.


Dhamaal Games said...

Great post!! This is very interesting blog and useful content. visit: Dhamaal Games

FuelDigi Marketing Pvt Ltd said...

Thank you for sharing such great information. Get the more details to know about the FuelDigi Marketing Pvt Ltd is one of the content marketing agency in chennai .For more info contact us: 91+ 9791811111 or visit our website : https://www.fueldigi.com/best-content-marketing-agency-services-chennai-fdm

Akshat Aggarwal said...

Your blog is very helpful and informative. I read this blog. Thanks For Sharing With Us. I will definitely go ahead and take advantage of this. Cheers for sharing with us your blog. For more learning go through 1stepGrow.
For Advance Data Science Course Advance Data Science Course

Nick said...

Thanks for sharing the blog.
Best Divorce Lawyers in Chennai

Nick said...

Thanks for sharing the Blog.
Hoarding Agency In Chennai

Writing Desk said...

Truly appreciate the work. Our dedicated and talented group of research analysts are spread across the globe ready to assist you and provide your minor nursing assignments with full accuracy.
Nursing assignment help