# Automatic Symbol Resolution on Embedded Platforms by the Example of Smart TV Device
## 6 Results  
As a result of our research, we have developed and extensively tested two methods for resolving removed symbols. One is based on finding characteristic binary values (Section 5.2) and the other is based on using dynamic localization of missing symbols based on string references (Section 5.3). As the second method proved to be much more reliable, we chose it as the basis for the new framework for symbol resolution on a Samsung Smart TV. To create malware or homebrew, one has to know which functions are available and which functions can be used. Therefore, the first step is to check binary for interesting functions. Then, knowing the function symbol, it is easier to proceed. However, in some firmwares (e.g., Samsung firmwares for series C) where symbols were removed, it is impossible to use the function name. Instead, one has to hardcode the function address, although it is only a temporary solution. In different versions of firmware functions, the address may differ. Using the framework presented in the article, a developer has to find a unique string reference, which is in the function they needed, or near it (because there is a slight difference in functions order between different firmwares), and localizes it in the used firmware. This approach solves a problem with different versions of firmware and also makes developed homebrew more universal. The prepared framework is a novelty in IoT security. It makes it much easier to resolve symbols in binaries of 200 megabytes or more in size that have thousands of unexported functions. By calling simple API (find_func_by_string), an attacker can deal with such a huge amount of binary data on a Smart TV and resolve all necessary functions without a negative effect on the device performance, which makes writing reliable exploits much easier (Figure 4). We have prepared a summary of different methods (Table 1) of resolving missing symbols in comparison to the developed framework. To further illustrate the differences between different methods, we have used bold font to highlight those aspects that are advantageous (take less time, allow for broader support, etc.). We used the same method to highlight methods that pass all criteria, which at the moment is only provided by the developed framework (Table 1). One of the possible attack scenarios using the presented framework may look as follows: The hacker may download the newest version of the firmware from the software vendor's website. Although many firmwares are encrypted, there are already available tools for firmware decryption. The problem of signed software can be overcome by turning off the options for checking whether the firmware is corrupted or not. When signing cannot be disabled, it is still possible to load shellcode into an already running application (like a web browser) and execute it using some kind of vulnerability that completely bypasses all kinds of security mechanisms. Moreover, thanks to the application of the developed framework, there is no need to modify the application in any way to support different firmware versions (Figure 4). Everything is handled internally, and the hacker or homebrew developer does not have to worry about missing symbols anymore. That is why stripping symbols is not a security but an obscurity, which cannot stop hackers and only slows down the homebrew community from extending the device capabilities. For example, before an automatic symbol resolution framework has been developed, projects available at the SamyGO forum were utilizing hardcoded addresses of functions which often made those tools unreliable (Figure 3).