Is possible to invoke an Android API without declaring the related permissions but with root access?

Question

While reversing some malware, I have realized that despite they use an exploit that gives them root access, such malware declares a lot of permissions in the manifest.

Because (AFAIK) "normal" apps that require the su executable they still need to declare the permissions in the manifest, because the su command just launches a child process with elevated (root, in this case) access.

Android malware reversing isn't my full-time job, but in my little experience this is the most common pattern among malicious apps:

1. exploit -> root access
2. change permission or remount partition
3. steal data from other apps

Thus, my question is: is possible to invoke an Android API (more precisely, the Java API framework) without declaring the related permissions but with root access?

I guess the answer is yes, but I think it's a twisted process, so it's easier to declare a lot of permissions (but it sticks out like a sore thumb).

Answer 1

The framework APIs do check for required permissions, so if you want to use those APIs, you do need the required permissions in the manifest. But of course, the root user can do any action regardless of permissions: it's just extra programming work to do the same low-level actions that the Android framework would do.