I am analyzing a mobile malware sample and got a trouble. When i put sample in JADX, i see some dollar sign. I mean like this;
What does these dollar signs means?
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this communityI am analyzing a mobile malware sample and got a trouble. When i put sample in JADX, i see some dollar sign. I mean like this;
What does these dollar signs means?
I'm pretty sure you're analyzing the SOVA malware.
The $
is used for the encrypted string character buffer as a name, as well as for the function name to decrypt strings from it.
It's basically just a very short function and variable name and because they have distinct namespaces, they can be the same but be two different things.
Jadx allows you to rename the function if you wish, or as the comment suggests, enable deobfuscation and you'll get something like m123$()
and f123$
instead.