Suppose I want to run some program which requests too many permissions. For example, record from the microphone or read IMEI of my phone. However, there are no practical explanation why recording from the mic or IMEI number is needed for this particular application, except for data mining.

I want to try this app, but restrict its permissions. For example, if it reads IMEI, it should get random IMEI (but the same every time). If it tries to read the mic, it should get silence.

Some other interesting permissions:

  1. Phonebook read/write access - returns zero contacts, pretend that write is OK, but actually do nothing.
  2. Send SMS - pretend that SMS is sent, but do nothing.
  3. Get list of visible Wi-Fi networks - return zero networks.

Obviously the tool should require a rooted phone. Are there any such tools?

  • 1
    I have been asking this question on stackexchange, but was directed here as this site has a wider android audience. – Denis Nikolaenko Dec 1 '10 at 23:23
  • 9
    I have never seen anything like this but I don't see why it couldn't be done. Its a good idea. – Matt Dec 2 '10 at 1:56
  • 1
    Could you use the emulator in the developer SDK to accomplish a lot of this? – ale Dec 2 '10 at 15:09
  • 5
    Basically, yes. Using emulator as a sandbox is possible. But what if I want to run an app on the physical phone, but keep my privacy? – Denis Nikolaenko Dec 2 '10 at 15:35
  • I know this question is old, but can you elaborate what context make you you want to test some malicious app on your own personal physical device and answer bogus personal data ? To me, current cyanogenmod solution (reject calls, do not produce fake data) seems enough. – Stéphane Gourichon Aug 21 '14 at 18:29

14 Answers 14


XPrivacyLua is a module for Xposed framework which does exactly what you need. It is free and open source. Works on rooted devices. It's the successor of XPrivacy.

Install Xposed from here: https://forum.xda-developers.com/showthread.php?t=3034811

You can then download the XPrivacyLua module from the Xposed repo through the Xposed Manager app, or manually from here:




If you're running Android 5 or lower, you can use the legacy XPrivacy module.

  • Very good tool. Exactly what I was craving for. – Denis Nikolaenko Jan 8 '15 at 15:07

Whisper Systems has come out with a custom ROM that has this exact feature: http://www.whispersys.com/permissions.html. As DarthNoodles mentions, it has to be done at the system level rather than the app level, which is how it is implemented in WhisperCore. The current version isn't able to block all of the permissions available on Android, but they are working on supporting more of them.

  • 1
    Source code is available only after purchase... – Denis Nikolaenko Sep 24 '11 at 13:04
  • Link is dead. Did they change names to OpenWhisper Systems and launch Signal? or is that a different group? – YetAnotherRandomUser Oct 2 '18 at 19:50
  • @YetAnotherRandomUser yeah, it's more or less the same group: signal.org/blog/welcome. Whisper Systems got acquired by Twitter. A bit later Moxie, one of the Whisper Systems founders, left Twitter and spun out some of the old Whisper Systems apps into an open-source project that became Signal. – Gary Peck Oct 2 '18 at 20:27

CyanogenMod 7.1 has exactly this feature, but without faking data, only failing, if the app accesses the API. Proposition for faking the IMEI was rejected. Faking other data, like contacts, is currently under discussion.

  • 1
    Steve Kondik explains why it was rejected in this post: plus.google.com/+SteveKondik/posts/iLrvqH8tbce Extract: "I rejected these patches since they create a hostile environment for applications, and that's not the direction I want to see CM go. (...) developers who don't want their apps running in unpredictable environments. (...) I think these patches are just more security theater and don't really solve a problem. Why do you want to run malicious applications anyway?" – Stéphane Gourichon Aug 21 '14 at 18:25

Not an absolute solution to your problem, but there is an app in the android market which caters to your needs. It also necessarily requires better knowledge about permissions and also a rooted device.

Permissions Denied is an app which allows you to effectively control the permissions that apps which are installed onto your phone, via the market or some other source. Also be aware that denying an app a permission that it is requesting may result in the app Force Closing. (hence requiring you to have better knowledge on how to use it)

Note : This app Requires Root Access. This app will not work on all device.

  • 1
    CyanogenMod is still better in this area, the app is currently flaky. – Denis Nikolaenko Jul 30 '11 at 23:43

This is no Sandbox Application, but perhaps it's also interesting for you, if you havn't already heard about it.

Some scientists startet the project Taintdroid. Realtime Privacy Monitory for Android


MockDroid is another academic firmware with data faking capabilities.


There is an excellent tool PDroid. It's both an App and a set of ROM patches, which enable intercepting and faking permission requests. Here are the PDroid Jellybean ROM Fork patches


It's a logical solution for a potential problem and a long time irritation of mine.

However, you must remember that whatever solutions are available for a security application would also be available for a malware app. If a security app could block net access then a malware app could block it also, stopping a security app from updating data files for instance.

It needs to be done at the system level, not as another application.

See my post here for my thoughts.

  • 4
    Such tools would require root access to the phone, if you grant it, should have an ultimate trust in the tool, like "Permissions Denied". If you grant root access to a random application from the market, you just shot yourself in the foot :) – Denis Nikolaenko Aug 3 '11 at 3:16

LBE Privacy Guard appears to be a very promising solution with interactive features to block or allow application activity on the fly.


A translated version of the Chinese version of LBE is available on XDA developers, and it works very well on Jelly Bean. Apparently the Chinese version is still actively developed.



There is an ongoing research on this this subject. A non yet released proof of concept is implemented for some of the privacy sensitive APIs exactly as I proposed. The privacy manager is called TISSA, short for Taming Information-Stealing Smartphone Applications.


There is a Privacy Blocker (paid) and Privacy Inspector (free) applications. Privacy Blocker does a static analysis of applications for sensitive API calls and rewrites these calls into stub ones which return fake data. As a result a new .apk with rewritten application is generated and installed. Privacy Inspector is an app which only reports the use of sensitive API calls.


Marshmallow (Android 6) has a new permissions model. Applications targeting Marshmallow can now be restricted to fewer permissions at runtime, and these applications should fail gracefully, rather than the all-or-nothing permissions model of prior Android versions. In Marshmallow, this is a feature of the standard OS, and does not require rooting or additional applications.

  • 1
    Hi mattm! It would be good if you go in-depth here. For example, the new permission model doesn't give any control on internet permissions. If possible, use screenshots for a more better way to make us understand what you're talking about. – Firelord Oct 31 '15 at 8:24

I'm fairly certain that tool that you seek doesn't exist yet. But your idea is great. Few point though;

ofc; app can freely read and write it's own app directory

giving fake read acces : for every possible read (and there's a lot app can try to read) default response should be generate; lot a work but doable

however; giving fake write access is lot harder; what if it uses sd card to store big temp files; like bitmaps. On unrooted phone; only place app can write is sd card; and using content provider (for stuff like contacts, and calendar). And app desiger isn't expecting to fail in writing data; so app could crash.

Good thing is that the worst that could happen is that app might crash.

  • Why down vote? At Dec 2010 these tools did not really exist. – Denis Nikolaenko Aug 3 '11 at 20:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.