Wednesday, August 31, 2011

Malware Analysis Tutorial 2 - Ring3 Debugging

Learning Objectives:
  • Efficiently master a Ring3 debugger such as Immunity Debugger
  • Can control program execution (step in, over, breakpoints)
  • Can monitor/change program state (registers, memory)
  • Comments annotation in Immunity Debugger
This tutorial can be used as a lab module in
  • Computer architecture
  • Operating systems
  • Discrete Maths (number system)
1. Introduction

To reverse engineer a malware, a quality debugger is essential. There are two types of debuggers: user level debuggers (such as OllyDbg, Immunity Debugger, and IDA Pro), and kernel debugger (such as WinDbg, SoftIce, and Syser). The difference between user/kernel level debuggers is that kernel debuggers run with higher privilege and hence can debug kernel device drivers and devices, while user level debuggers cannot. It is well known that modern OS such as Windows relies on the processor (e.g., Intel CPU) to provide a layered collection of protection domains. For example, on a typical Intel CPU, programs can run in four modes, from ring0 (kernel mode) to ring3 (user level). In this case, we also call user level debuggers "ring3 debuggers".

A natural question you might have is: Since ring0 debuggers are more powerful than ring3 debuggers, why not use ring0 debuggers directly? Well, there is no free lunch as always. Ring3 debuggers usually come with a nice GUI which can greatly improve the productivity of a reverse engineer. Only when necessary, we'll use the command-line ring0 debuggers (such as WinDbg). There is one exception though - recently, IDA Pro has introduced a GUI module which can drive WinDbg for kernel debugging. This is a nice feature and you'll have to pay for it.

In this tutorial, we assume that you would like to use open-source/free software tools. The following is a combination of debuggers we'll use throughout the tutorial: Immunity Debugger (IMM for short) and WinDbg.

2. Brief Tour of IMM

Now we will have a brief introduction of IMM. If you have not installed your Virtual Machine test bed, check out the first tutorial Malware Analysis Tutorial - A Reverse Engineering Approach (Lesson 1: VM Based Analysis Platform) for setting up the experimental platform.

Figure 1. Screenshot of IMM

As shown in Figure 1, from left-top anti-clockwise, we have the CPU pane (which shows the sequence of machine instructions and user comments), the Register pane (which you can watch and modify the values of registers), the Stack pane and the Memory dump. Before we try to reverse engineer the first section of Max++, it is beneficial to learn how to use the short-cut keys in the debugger efficiently.

In general, to use a debugger efficiently, you need to know  the following :
  1. How to control the execution flow? (F8 - step over, F7 - step in, F9 - continue, Shift+F9 - continue and intercept exceptions)
  2. How to examine data? (In Memroy pane: right click -> binary -> edit, in Register pane: right click -> edit)
  3. How to set breakpoints? (F2 for toggle soft-breakpoint, F4 - run to the cursor, right click on instruction -> Breakpoint -> for hardware and memory access point)
  4. Annotation (; for placing a comment)
Most of the above can be found in the Debug menu of the IMM debugger, however, it's always beneficial to remember the shortcut keys. We now briefly explain some of the functions that are very useful in the analysis.

2.1 Execution Flow Control

The difference between step over/step in is similar to all other debuggers. Step in (F7) gets into the function body of a Call instruction. Step over (F8) executes the whole function and then stops at the next immediate instruction. Notice that F8 may not always get you the result you desire -- many malware employ anti-debugging techniques and use return-oriented programming technique to redirect program control flow (and the execution will never hit the next instruction). We will later see an example in Max++.

F9 (continue) is often used to continue from a breakpoint. Notice that the debugger automatically handles a lot of exceptions for you. If you want to intercept all exceptions, you should use SHIFT+F9. Later, we will see an example that Max++ re-writes the SEH (structured exception handler) to detect the existence of debuggers. To circumvent that anti-debug trick, you will use SHIFT+F9 to manually inspect SEH code.

2.2 Data Manipulation

In general, you have three types of data to manage: (1) registers, (2) stack, and (3) all other segments (code, data, and heap).

To change the value of a register, you can right click on the register and select Edit to change its value. Notice that when a register contains a memory pointer (the address of a memory slot), it is very convenient to right click on it and select "Follow in Dump" or "Follow in Stack" to watch its value.

The design of IMM does not allow you to directly change the value of EIP register in the Register pane. However, it is possible to change EIP using the Python shell window. We leave it as a homework question for you to figure out how to change EIP.

In the Memory Dump pane, select and right click on any data, and then select Binary->Edit. You can enter data conveniently (either as a string or binary number).

You are able to reset the code (as data). In CPU pane, right click and select "Assemble", you can directly modify the code segment by typing assembly instructions! You can even modify a program using this nice feature. For example, after modifying the code segment, you can save the modified program using the following approach:

   (1) Right click in CPU pane
   (2) Copy to Executable
   (3) Copy All
   (4) Close the dialog window (list of instructions that are modified)
   (5) Then a dialog asking for "save the file" pops. Select "yes" and save it as a new executable file.
2.3 Breakpoints

Software breakpoints (F2) are the post popular breakpoints. It is similar to the breakpoints available in your high-level language debuggers. You can have an unlimited soft breakpoints (BPs) and you can set conditions on a soft BP (e.g., to specify that the BP should stop the program only when the value of a register is equal to a certain number).

Soft BPs are implemented using the INT 3 instruction. Basically, whenever you set a breakpoint at a location, the debugger replaces the FIRST byte of that instruction with INT 3 (a one-byte instruction), and saves the old byte. Whenever the program executes to that location, an interrupt is generated and the debugger is called to handle that exception. So the debugger can then perform the condition check on the breakpoint and stop the program.

Hareware breakpoints can be set by right click in the CPU pane and then select Breakpoints -> Hardware, on execution. Notice that there are two other types hard BPs availalbe (memory read, memory access). As its name suggests, hard BPs are accomplished by taking advantage of hardware. On a Intel CPU, there are four hardware BP registers which records the location of hard BPs. This means that at any time, you can have up to 4 hard BPs.

Hardware BPs are very useful if you need to find out which part of the code modifies a variable. Just set a memory access BP on it and you don't have to look over the entire source code to find it out.

2.4 User Annotation

Although seemingly trivial, user comments and annotation is a very important function during a reverse engineering effort. In the CPU pane, pressing ";" allows you to add a comment to a machine instruction and pressing ":" allows you to label a location. Later when the location is referred to as a variable or a function, its label will be displayed. This will greatly ease the process of analysis.

3. Challenges of the Day

It's time to roll-up your sleeves and put all we have learned into practice! The objective today is to analyze the code snippet from 0x413BC8 to 0x413BD8. Answer the following questions. We will post the solution to these questions in the comments area.

Q1. What is the value of EAX at 0x413BD5 (right before int 2d is executed)?
Q2. Is the instruction "RET" at 0x413BD7 ever executed?
Q3. If you change the value of EAX to 0 (at 0x413BD5), does it make any difference for Q2?
Q4. Can you change the value of EIP at 0x413BD5 so that the int 2d instruction is skipped?
Q5. Modify the int 2d instruction at (0x413BD7) to "NOP" (no operations) and save the file as "max2.exe". Execute max2.exe. Do you observe any difference of the malware behavior? (check tutorial 1 Malware Analysis Tutorial - A Reverse Engineering Approach (Lesson 1: VM Based Analysis Platform) for monitoring the network traffic)


  1. This comment has been removed by the author.

  2. Q1. The value of the EAX register is 1.

    Q2. The ret is never executed, it is skipped.

    Q3. Yes, the ret will be executed.

    Q4. Yes, with a the python shell window you can change the EIP.

    Q5. Yes, the malware does not run. Without the int 2d instruction, the ret is executed and the program does not call the MAX++ function.

  3. at Q5 you have put wrong address.

  4. The address in Q5 is correct. Check Figure 1 again.

  5. Outstanding stuff here Dr Fu. Great work and great contribution to the malware analysis community.
    Thank you,
    David aka IndiGenus

  6. It would be great if you could post how to change the EIP here in comments.

  7. From a Python Shell

    >>> imm = immlib.Debugger()
    >>> imm.setReg('EIP',int("hex value",16))

  8. Thank you Dr.Fu !
    I am eager to learn moar!

  9. I think I've downloaded another sample, I mean, the entry point is totally different from yours in Figure 1. Could someone please upload the sample again?...

  10. Hello Dr. Fu, first thanks for this great tutorial.

    As you said "However, it is possible to change EIP using the Python shell window".

    However, I found another simple solution for this, similar like on Ollydbg, by right click the new EIP destination address on CPU window and select "New origin here". Is this a different?

  11. Hi,
    I am having a bit of trouble with the Q3.
    If I change the value of EAx to zero, still the RETN is NOT executed.
    However, if I put a soft-breakpoint and also change the value of EAX then RETN is executed.

    Please let me know if this is the right thing to do or am I missing something? As stated in the question there is no breakpoint mentioned.

    Thank you in advance


  13. Thank you Dr. Fu, I really enjoyed this tutorial. I've been learning Malware Analysis for the past 3 or so months, and I learned a few things about the debugger! :)

  14. Q1. The value of the EAX register 1.

    Q2. The ret is never executed, it is skipped.

    Q3. No, stil is not executed.

    Q4. Yes, execution goes to retn and program is terminated.

    Q5. Yes, the malware does not run. Without the int 2d instruction, the retn is executed and program is terminated.

  15. Quantum Binary Signals

    Professional trading signals sent to your mobile phone every day.

    Start following our signals today and gain up to 270% per day.

  16. Thanks for sharing, very informative blog.

  17. Nice information, valuable and excellent design, as share good stuff with good ideas and concepts, lots of great information and inspiration, both of which I need, thanks to offer such a helpful information here.
    Data Science Online Training | Data Science Online Certification

  18. In the quest for quality grades, students have realized the need for working with Nursing Paper Writing Service agencies that specialize in various types of essay writing. They are the best company that handles Best Proofreading Service and Affordable Editing Services.

    Virtual DJ Pro Crack is the audio-video mixing software with its breakthrough and beat lock engine. It is one of the famous software programs in the entire market and becomes the number one software. While the automatic loops of it are the seamless and also synchronized sampler which lets you the Virtual DJ Pro Keygen perform and astounding the remix which is life. Furthermore, the representation that is visual that can cue which is allowed to DJ too see the song and structure clearly.

  20. nfs most wanted download pc
    NFS Most Wanted Pc Download: an openworld action Car Racing Video Game. Criterion Games developed NFS Most Wanted Torrent. Electronics Arts published Need For Speed Most Wanted Pc Download Free Full Version. It is the 19th installment in the Need For Speed Games. Need For Speed Most Wanted Free Download Pc Game features both single player as well as the multiplayer gameplay modes.

    Revo Uninstaller Crack is a useful place where you can easily find Activators, Patch, Full version software Free Download, License key, serial key, keygen, Activation Key and Torrents. Get all of these by easily just on a single click.

    Smadav Pro Crack pro is the small and lightweight entity of the tool. It is really secure and efficient software. It makes your system secure and safe. It is most widely too used all over the world. It is used on mobile and laptops. It provides you security checks and threats of data. It is a type of antivirus. It means it protects your pc and mobile phone at all. You can take advantage of installing it in your system. It removes the virus and makes your system virus free. It cannot allow any threat which may damage your pc data.

    Lightworks Pro Crack is software. That gives good help. This service is used to change the videos. This software is a master changing component. It is used in film making to edit in the movies. It allows us to produce and change video clips. The software also pays the draw images. It also pays the audio data short clips to choose the video.

    CINEMA 4D Crack is a 3D modelling software. That is most widely used for animation, rendering, graphics, and motions, etc. it is one of the top 50 graphics design products. It modified your requirements.

    Device Doctor Pro Crack is very simple software, which function is to scan the device for new updates. If you have any kind of device it checks it very smoothly, using the internet is there any kind of update or not. Amazing thing is that it supports up to 3 terabytes of drivers. You have no need to use any updated operating system for its use. It supports a minimum 32 bit of operating system also. The software is very beneficial of the laptop users. And, this software is very easy to use no need for any science to operate it.

    Revo Uninstaller Pro Crack a potent utility to get rid of and disable apps without any remnants, tails, and traces on your computer. As everyone probably knows, lots of software throughout setup to create diverse files. Folders and registry entries in distinct regions of the technique. This app tracks real-time exactly what effects have been made into this machine from new applications and also carries those changes under consideration in its work. Even if you have not tracked the installment of an app, it’s still feasible to disable it manually via a setup log. This may occur employing the logs out of your Logs Database.

    mIRC Crack can be a social network that employs the Internet Relay Chat protocol. Its principal goal is always to make a digital connection involving users all around over the Earth, who is able to convey using its own conversation capacities. Additionally, in addition, it has scripting terminology, making it symmetrical and thoroughly user-friendly. If you require staff talks or one-on-one private requirements, this program is best for you personally.

    Deezer Crack is a useful place where you can easily find Activators, Patch, Full version software Free Download, License key, serial key, keygen, Activation Key and Torrents. Get all of these by easily just on a single click.

    FL Studio Final Crack is the most powerful production tool. While, it is developed by the Fruity Edition, and Also the Signature Bundle. The features are available in line with the sound editing and also the audio. While the most recent variant contains all that you require for. Fl-studio can be an audio platform. All you’re looking for in one package to write. While you need to organize, document, edit, combine, and also genius proficient excellent new music.

  30. download halo 2
    Halo 2 Pc Game: is a famous action war fighting and shooting and Fighting Pc Game. Bungie Games developed it and Microsoft Games Studio Entertainments published Halo 2 Torrent worldwide for all platforms.

  31. Good article! I found some useful educational information in your blog about Data Science, it was awesome to read, thanks for sharing this great content to my vision.
    Java training in chennai | Java training in annanagar | Java training in omr | Java training in porur | Java training in tambaram | Java training in velachery

    Lucky Patcher Mod is an incredible Android application which let you to expel promotions from Android applications and games, alter authorizations of various applications and games, sidestep permit check of premium applications, reinforcement downloaded applications and games, evacuate framework applications if a bit much, reinforcement adjusted applications and so forth. How about we see a portion of the highlights of fortunate patcher mod application.

  33. This is excellent information. It is amazing and wonderful to visit your site.Thanks for sharing this information,this is useful to me.

    Microsoft Azure Online Training

    Microsoft Azure Classes Online

    Microsoft Azure Training Online

    Online Microsoft Azure Course

    Microsoft Azure Course Online

  34. Wow it is really wonderful and awesome thus it is very much useful for me to understand many concepts and helped me a lot.

    Informatica Online Training

    Informatica Classes Online

    Informatica Training Online

    Online Informatica Course

    Informatica Course Online

  35. After reading your article I was amazed. I know that you explain it very well. And I hope that other readers will also experience how I feel after reading your article.

    angular 7 training in bangalore

    angular 7 courses in bangalore

    angular 7 classes in bangalore

    angular 7 training institute in bangalore

    angular 7 course syllabus

    best angular 7 training

    angular 7 training centers

  36. Every one of us might face health disorders at any stage of our life. For the treatment of these diseases or infections doctors recommend several type of medicines. But you must know that every medicine have some side effects as well as its benefits. So you must know the full information about this medicine and exact dosage required. So you must like it for


  37. Very interesting blog. Many blogs I see these days do not really provide anything that attracts others, but believe me the way you interact is literally awesome.You can also check my articles as well.

    Security Guard License
    Ontario Security License
    Security License Ontario
    Security License

    Thank you..

  38. nfs no limits for pc
    NFS Most Wanted 2012 (Need For Speed Most Wanted) Free Download Full Version Highly Compressed Pc Game is a famous car racing game. Critrion Games developed NFS Most Wanted Torrent and EA Entertainments published the game world wide.

  39. tramadol 50mg uses
    Tramal Tablets contains Tramadol HCL which is centrally acting analgesic with a unique, dual mechanism of action with the CNS. Tramadol Tablets is effective in the control of post operative pain. But it is suitable as an adjunct to anesthesia because of low sedative properties it has. Tramadol Brand Name is Tramal Tablets.

  40. Braiding hair is cheap and best quality product with new silky hairs.
    Kanekalon Weave

  41. Nice Post. Very informative Message and found a great post. Thank you. Rajasthan Budget Tours

  42. great tips for aws we at SynergisticIT offer the best aws training in California

  43. Great read! Thank you for such useful insights. Visit here for latest tech courses on MALWARE ANALYSIS ONLINE TRAINING

  44. Artweaver Plus is a powerful and the latest photo editor software. The software contains a fully advanced toolkit for creating image files.

  45. YouTube By Click Premium is a windows based software to treat with the downloading tasks from the different online resources.

  46. Reimage PC Repair is a digital system repair software. It rids the User of threatening or malfunctioning files.

  47. Lumion Pro
    Cracked Here is a useful place where you can easily find Activators, Patch, Full version software Free Download, License key, serial key, keygen, Activation Key and Torrents. Get all of these by easily just on a single click.

  48. Talha PC!

    Driver Reviver Crack!

    Driver Reviver Crack is capable of identifying and refreshing all hardware drivers. This software permits you to download the modern-day drivers directly to your PC. It uses all the equipment to make your computer quicker and better. Driver Reviver Crack scans both hardware and software drivers on your PC to check it for the modern driver updates. You may be wasting your time monitoring down the driver for each piece of hardware whilst the application will do all this in minutes.

  49. Talha PC!

    Adobe Acrobat Pro DC Crack!

    Adobe Acrobat Pro DC Crack is the world’s fine software that allows you to create, manage, convert, extract, and annotating PDF files. Users can create PDF file varieties of documents. Additionally, you can also scan snapshots and documents to make new PDF files. It is more effective than any other PDF software. Extract elements of the text, keep the images in excessive-quality, and even more. Now, sharing PDFs and gathering comments is like sending an email.

  50. ESET NOD32 Antivirus
    Cracked Here is a useful place where you can easily find Activators, Patch, Full version software Free Download, License key, serial key, keygen, Activation Key and Torrents. Get all of these by easily just on a single click.

  51. Talha PC!

    Avast Premium Security Crack!

    Avast Premium Security Crack is powerful anti-virus software for operating structures like Windows, As of now creates protection freeware and shareware applications beneath the Avast mark for character and business utilizes on PCs, Macs, and Android gadgets, and beginning at 2013 in extra of 200 million devices global were valued for to have utilized Avast items.

  52. BlueStacks
    BlueStacks Crack is an easy-to-use application that you can use to run Android apps on your PC.

  53. Hotspot Shield!
    Hotspot Shield VPN Crack is the planet’s most trusted Internet security system performance.

  54. Retail Man POS lets you access every account information. We can change our account by using this. When we want to see our screen on other laptops and computers. We use Retail Man POS free download full version in any type of retailing business. This software is used in shopping malls and many other factories. Moreover, this is also useful in CA engineering. This is an excellent tool to manage and organize stock, sales, and purchase. We can show our mall’s money information on the computer. Home

  55. Highly Compressed Pc Games Download
    everyone of us want to find games that perfectly match your moods and you can easily play them in your free time to entertain yourself.
    So this is the best place to get all type of games to play online or offline locally on your computers.

  56. I have read your article. It is very informative and helpful for me. I admire the valuable information you offer in your articles. And I am sharing your post in my friends. Thanks for posting it.

    Sony Vegas Pro Crack

  57. I have read your article, it is really interesting and has lots of useful information. I also recommend it to friends so they can read it and they see the same thing. Thanks for sharing.
    KeyShot Pro Crack

  58. I have read your article. It is very informative and helpful for me. I admire the valuable information you offer in your articles. And I am sharing your post in my friends. Thanks for posting it.
    avast antivirus crack

  59. Everyone of contributor here on this post has shared his own thoughts. So if you are willing to play Highly Compressed Pc Games you must be thinking of some entertainments. so it means you are tired of your bore times and thats why the games are the best way to entertain yourself. so lets play and enjoy yourself

  60. Pharmacy is the clinical health science that links medical science with chemistry and it is charged with the discovery, production, disposal, safe and effective use, and control of medications and drugs.
    mr 35

  61. Great Article
    Cyber Security Projects

    Networking Security Projects

    JavaScript Training in Chennai

    JavaScript Training in Chennai

    The Angular Training covers a wide range of topics including Components, Angular Directives, Angular Services, Pipes, security fundamentals, Routing, and Angular programmability. The new Angular TRaining will lay the foundation you need to specialise in Single Page Application developer. Angular Training

  62. UltraISO Premium Edition
    UltraISO Premium Edition Crack UltraISO is a tool for creating / editing / converting CD / DVD image files.

  63. Savage The Shard Of Gosen Free Download Pc Game Savage The Shard Of Gosen Free Download Full Pc Game is basically an action, adventure 2D game.
    download fallout 3 highly compressed

  64. Thanks for Sharing This Article.It is very so much valuable content. I hope these Commenting lists will help to my website
    mulesoft online training
    best mulesoft online training
    top mulesoft online training

  65. if you are searching and like to play games you are here on a right place. Its very hard to find the perfect games accroding to your mood and liking.
    But i recommend you a best place if you want to games download full version you would love to visit it once.
    Lets give it a try i am sure you will always love to be here again and again.

  66. Easily download videos and music directly from the Internet onto your device. All formats are supported. 100% free! Free Video downloader auto detects videos
    mood messenger for iphone

    Tenorshare 4uKey Crack is an easy way of tool or software which is designed to unlock the android devices like tablet, iPhone and iPad.

    Total Video Converter Crack is an all in one good video converter and DVD burner package. It fully supports all popular video and audio formats.

    NCH VideoPad Video Editor Crack is the software for every type of solution of video and to work with video. This video editor software has a collection of all common video formats. Also has many other features like sound editing, video cropping, trimming, and many more features.

    Save Wizard Crack has actual cheats and can resign running saves from others. With it, you can directly install modern cheats and games. Save Wizard for PS4 MAX provides you with recovery authority.

    Wondershare Dr.Fone Crack easily solve your mobile problems. It is a program run to backup all lost IOS data. Several IOS and Android solutions are available on Windows and Mac platforms. It backup files and broken Android devices. It shares data between your IOS, Android and computer and iTunes. You can choose files to recover from any device.

    FL Studio Crack the purpose of developing this software is to create my own music. With the help of this multiple sounds easily combine into one. So this is fantastic software.

    Advanced SystemCare Pro Crack is the best program to find the issues and take care of problems related to the continuing future of your PC. Within a few clicks, you will be able to solve a few of the most frequent Computer problems such as delays,

  74. Your source for fun, free mobile and PC download games. Thousands of free ... Download or play free online! ... Here is the Exact Arcade Version of Dig Dug!
    need for speed no limits download torrent

  75. good work is done here. thanks and keep sharing.

  76. This comment has been removed by the author.

  77. Your source for fun, free mobile and PC download games. Thousands of free ... Download or play free online! ... Here is the Exact Arcade Version of Dig Dug!


  78. Great Post with valuable information. I am glad that I have visited this site. Share more updates.
    Firebase Training Course
    English Speaking Course Online
    jira online training

  79. This is Very very nice article. Everyone should read. Thanks for sharing. Don't miss WORLD'S BEST GAME 4 👉 CARGAMES

  80. ring0 debuggers are more powerful than ring3 debuggers.
    IObit iFun Screen Recorder Crack

  81. I'm impressed along with your weblog such a nice post.
    iTubego Downloader Crack

  82. I have also done and analyzed it successfully after reading the important instructions in the content of this article. Thank you for sharing it with everyone.

    five nights at baldi's official download

  83. This article is awesome. It helps me identify malware in the easiest way.

    rebind mod

  84. BB15Video This Website Is Official Website Bigg Boss Full Episodes Online Video Streaming On Bigg Boss 15 Live Play For More Detail Visit This Website HOtstar Serials And Apne tv Serials Bogg Boss 15 Live Video, Bigg Boss 15 Online Watch bb15live.

    Bigg Boss 15 online

  85. Bigg boss 15 All Episodes Watch Online Bigg Boss 15 Full Episodes Today show Video is Gourgius show is Salman khan show Voot tv and Colors tv serial Colors TV. Original release On bb15watch Official website Bigg Boss Season 15 Live Streaming And HD Server Videos You Can Play This Video

    Bigg Boss 15 Online

  86. Aapki Nazron Ne Samjha Full Episodes Online This Drama Star Plus Hindi Serial Desi Channel Reality Drama show Online Subscribe now to Aapki Nazron Ne Samjha Live Drama Today Episodes.
    aap ki nazron ne samjha Full Episode

  87. Khatron Ke Khiladi Season 11 Made In India Reality Show Please Watch This Website Watch Online Khtron Ke khiladi Show Hosted By Rohid Shetty With Faran Khan. Khatron Ke Khiladi Season 11 All Episodes Online Quality Streaming of all Kkk 11 Live.
    khatron ke khiladi Full Episode

  88. Your website is great, it provides a lot of useful information and images about life and people. At the same time also add moments of entertainment for users.

    five nights at freddys 4

  89. Your website helps people to have more knowledge about society and life. Is a great website.

    code chicken lib 1 8 mod

  90. Aiseesoft FoneLab For iOS Serial Key is the fastest and most reliable software to recover data from iOS devices. You can retrieve text messages, calls, music and movies from iPhone / iPad / iPod devices.
    Aiseesoft FoneLab For iOS Serial Key

  91. Camtasia Keygen Full Download contains a huge library with lots of free songs and sound effects for all Windows and Mac users. It also allows you to even record your own audio clip and insert any video easily.
    Camtasia Activation Key

  92. This reveals which RAR records are password protected and there is no problem using the protection and security equation. PassFab for RAR Serial Keys offers three types of successful attacks. It is possible to test all password combinations (in case you lose your security password, however, you need a maximum period of time), and incredible compression with mask attack (in case you still consider a part of your name username and password), Thesaurus Loop (based on a pre-installed or self-developed thesaurus. EaseUS Data Recovery Crack.
    Free Software Crack

  93. I listen about this website from my friend. He was admiring this alot. So, thats why I am here to visit this. And he was right. I found a quite nice information form this website. I will also share this site with my other friend to visit and enjoy it free.

  94. I dont have the time at the moment to fully read your site but I have bookmarked it and also add your RSS feeds. I will be back in a day or two. thanks for a great site.
    BlueStacks Crack
    ESET Internet Security Crack
    VueScan Crack
    Smadav Pro Crack
    Minecraft Crack
    KeyShot Pro Crack
    Avast Antivirus Crack

  95. until dawn pc download free game full version interactive drama horror video game developed by Supermassive Games and published by Sony Computer Entertainment for the PlayStation 4. Players assume control of eight young adults who have to survive on Blackwood Mountain when their lives are threatened Eight friends are trapped together on a remote mountain retreat, and they aren't alone. Gripped by dread, with tensions running high, they must fight through their live saving process.

  96. Bigg Boss 15 All Episodes In Colors Tv Official website on bigg boss 15 MX Player watch Online
    Voot App This Is a Real Website Bigg Boss 15 Show. This Show Owner Is Salman Khan. Bigg Boss 15 Full Episode.

    Bigg Boss 15 MX Player

  97. Hey, I'm Santana. I'm from The United States. I'm a Software Engineer. Here's my web URL

    And I make Softwares like::

  98. Your source for fun, free mobile and PC download games. Thousands of free . Download or play free online! . Here is the Exact Arcade Version of Dig Dug!

  99. Download Full Crack Version;


  100. it is the best website for all of us. it provides all types of software and apps which we need. you can visit this website.

  101. Melayu
    Kepala Bergetar
    tonton drama
    kepala Bergetar And Kbergetar tonton is Malaysia's largest video streaming service layanon9 with over 8 melayu drama million users. Kbergetar The new & improved tonton is now absolutely FREE! Watch the best local content Tonton Drama.


  103. Thanks dear for sharing such an informative content. I am really happy to found your blog. You make me perfect.
    Free Software Download

  104. CyberGhost VPN Activation Code is a unilateral tick response in due order regarding the content of prohibited, restricted, and restricted locations with their Secure VPN affiliations.
    CyberGhost VPN Activation Code

  105. Nice Post, I like it very much because its really beneficial

  106. FK system is invisibly made, making the display of character animation fluid and logical. Let me help you understand and you can use Cartoon Animator Crack to find a world full of happiness and more.

  107. Shadow Fight 2 Cracked Keygen is a game especially for martial artists who are Shades of Black. You will be familiar with the unidentified characters from the classic games.

  108. It's clearly solid for you basically all window programming installation. This website online is confounding its article are crucial and fascinating. I took pride in and bookmark this web page on my chrome. This is in which you can get all run programming in like way present in a clean way .

  109. It's clearly solid for you basically all window programming installation. This website online is confounding its article are crucial and fascinating. I took pride in and bookmark this web page on my chrome. This is in which you can get all run programming in like way present in a clean way .

  110. It's clearly solid for you basically all window programming installation. This website online is confounding its article are crucial and fascinating. I took pride in and bookmark this web page on my chrome. This is in which you can get all run programming in like way present in a clean way .


  111. Big boss is one of the most widely famous public show
    Audience always enjoy this show with a great joy.

    Bigg Boss 15 watch Online

  112. Thank you, I’ve recently been searching for information about this subject for a long time and yours is the best I have found out so far.