I'm a beginner learning mobile appsec. I just wanted to know if there is a standard way to identify if a mobile application is native or hybrid by looking at the apk file?
If it uses native code, then it should have references to
System.loadLibrary(). But ...
It could also just execute something native with
ProcessBuilder, or use
DexClassLoader to load a dex/jar which then performs this. But ...
Unfortunately, this could also be worked around, since Java could use reflection to hide any of the mentioned class/method names from static analysis.