I am supposed to perform static analysis of an APK that has a lot of permissions requested in the Manifest.

I would like to find out whether all the permissions requested are really needed by the app to perform some action.

When I read documentation for a specific permission, it hardly mentions what actions (API calls, object initiations, broadcasts etc.) are specifically protected by that permission.

For example: When I read the docs of READ_PHONE_STATE here, it never mentions the actual API calls protected by the permission. I need to google and find that the user needs this permission to call some methods of TelephonyManager, which is something that I can try to find in the Smali code of my APK to verify that the permission is really needed.

So my question is: Is there some documentation, website or list, where I could easily find all assets protected by various Android permissions? The documentation usually contains all permission needed by a specific call, but it does not contain all calls protected by a specific permission.

  • I don't think you'll find all information at one place. It's scattered over developer.android.com and AOSP source code. In particular Android platform's manifest file can be of a little help. – Irfan Latif Oct 20 '20 at 13:46
  • In recent versions of Android the Android source code for the API used by AndroidStudio contains RequiresPermission annotations on methods that specify which permissions are required to cal it. Of course there are other ways to make use of a permission that those API calls. – Robert Oct 20 '20 at 15:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.