I'm a beginner learning mobile appsec. I just wanted to know if there is a standard way to identify if a mobile application is native or hybrid by looking at the apk file?

  • I think this is an Android programming question, not a security one, even though you hope to use the answer for security purposes. – schroeder Jan 11 '17 at 9:32

If it uses native code, then it should have references to System.load() or System.loadLibrary(). But ...

It could also just execute something native with Runtime or ProcessBuilder, or use DexClassLoader to load a dex/jar which then performs this. But ...

Unfortunately, this could also be worked around, since Java could use reflection to hide any of the mentioned class/method names from static analysis.

  • Thanks domen.. I remember googling about this, where I read, if the application code contains 'webView' keyword then it could be a Hybrid application?? I don't know if its really that way.. Your inputs pls... – VAPT Learner Jan 11 '17 at 11:47
  • I don't understand the question. You read that apps containing WebView load native code? There's no obvious relation. Of course if you dig deep enough, you eventually come to native code, but that holds for many things (anything with system calls at least). – domen Jan 11 '17 at 13:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.