Tool to statically analyze permission references within decompiled Android M apps.

With the release of Android 6.0 (Android M / API Level 23), users can now grant system and 3rd party permissions at runtime instead of during installation.

This increases an application's susceptibility to over and underprivileging. If a normal (as opposed to dangerous) permission is defined in the app manifest, the system grants that permission automatically -- even if the app is not using the permission directly. However, users can grant all permissions, including dangerous, within a permission group by requiring a single permission. This may result in overprivileging. For convenience, design and further documentation is in the wiki.

1. If an app requests a normal permission it will be granted immediately. View the list of normal permissions here.
2. If an app requests a dangerous permission listed in its manifest, and the app already has another dangerous permission in the same permission group, the system immediately grants the permission without any interaction with the user.
3. Permissions defined in the manifest and never referenced in source are considered overprivileged.
4. Permissions not defined in the manifest, and refereneced in the source, are considered underprivileged.

MPermission requires Python 3.0 - 3.4.

You may also need to update Apktool, dex2jar, and JD-Core-java.

Download the latest version of Apktool, rename the jar file to 'apktool.jar', and then place it in android-scraper/tools/apk-decompiler/lib/

Download the latest version of dex2jar, unzip the contents and rename the folder to 'dex2jar', and then place it in android-scraper/tools/apk-decompiler/lib/

JD-Core-java requires Oracle JDK and Mercurial to build:

% apt-get install mercurial

Follow the build instructions for JD-Core-java to generate a jar file (project can be found on the VM desktop). Rename the file to 'jd-core-java.jar' and then place it in android-scraper/tools/apk-decompiler/lib/

Now install any package dependencies:

% pip install -r requirements.txt

You should now be ready to decompile and analyze some Android M apps.

The tool can be run incrementally with the following flags:

% python3 MPerm.py -d [--decompile] apk_path              # decompiles APK and moves it to sample_apk/ - This could take a few minutes depending on the size of the APK
% python3 MPerm.py -a [--analyze]   decompiled_apk_path [android_api_version_number_targeted]   # analyze and prints source report / analysis report against the specified API level number
% python3 MPerm.py -f [--fullprocess]   _apk_path [android_api_version_number_targeted]   # decompiles APK, analyzes against the specified API level number and prints source report / analysis report, then deletes the decompiled source folder

In the event of any issues, there are some things you can try.

If the app wont't de-compile:

1. Make sure to have the latest versions of Apktool, dex2jar and JD-Core-java.
2. Make sure the apps being examined are API 23 (Marshmallow) or greater.
3. If you continue to encounter problebms, use the provided Virtual Machine.