https://github.com/OWASP/owasp-mstg/blob/master/Document/0x0... has all the relevant information, including reversing apps using native libraries to hide functionality.