I am supposed to perform static analysis of an APK that has a lot of permissions requested in the Manifest.
I would like to find out whether all the permissions requested are really needed by the app to perform some action.
When I read documentation for a specific permission, it hardly mentions what actions (API calls, object initiations, broadcasts etc.) are specifically protected by that permission.
For example: When I read the docs of READ_PHONE_STATE
here, it never mentions the actual API calls protected by the permission. I need to google and find that the user needs this permission to call some methods of TelephonyManager
, which is something that I can try to find in the Smali code of my APK to verify that the permission is really needed.
So my question is: Is there some documentation, website or list, where I could easily find all assets protected by various Android permissions? The documentation usually contains all permission needed by a specific call, but it does not contain all calls protected by a specific permission.
RequiresPermission
annotations on methods that specify which permissions are required to cal it. Of course there are other ways to make use of a permission that those API calls. – Robert Oct 20 '20 at 15:10