Migrating to runtime permissions: How do you find all the current permission uses?

Question

Is there an easy way to identify all the API calls an Android app makes that need to be adapted to use runtime permissions in Android M (6, API 23)?

It appears that you just have to figure it out by testing, trial & error, or expert knowledge (eg: pouring over the API docs and your source code). I expected that Google would release a migration tool, but I haven't seen any evidence of that. Not doing so looks as though it will leave your apps vulnerable to runtime crashes if anyone disables access to a permission post-install, even if you aren't using the runtime permission tags in your manifest.

What are the best practices for migrating to runtime permissions?

Answer 1

I wasn't able to find any existing tools, so our team at Galois adapted a static analysis tool we created over the past ~4 years to identify permission-protected method calls in binary Android apps.

You can use it at:

• http://fuseanalyzer.com

There are more details here:

http://galois.com/blog/2015/10/fuse-analyzer-handling-runtime-permissions-android-6-0/