Are there any tools to sandbox a malware application even more than the granted permissions on Android? Suppose I want to run some program which requests too many permissions. For example, record from the microphone or read IMEI of my phone. However, there are no practical explanation why recording from the mic or IMEI number is needed for this particular application, except for data mining.

I want to try this app, but restrict its permissions. For example, if it reads IMEI, it should get random IMEI (but the same every time). If it tries to read the mic, it should get silence.

Some other interesting permissions:


Phonebook read/write access -
returns zero contacts, pretend that
write is OK, but actually do
nothing. 
Send SMS - pretend that SMS
is sent, but do nothing. 
Get list of
visible Wi-Fi networks - return zero
networks.


Obviously the tool should require a rooted phone. Are there any such tools?
XPrivacyLua is a module for Xposed framework which does exactly what you need. It is free and open source. Works on rooted devices. It's the successor of XPrivacy.

Install Xposed from here:
https://forum.xda-developers.com/showthread.php?t=3034811

You can then download the XPrivacyLua module from the Xposed repo through the Xposed Manager app, or manually from here:

https://repo.xposed.info/module/eu.faircode.xlua

Source:

https://github.com/M66B/XPrivacyLua



If you're running Android 5 or lower, you can use the legacy XPrivacy module.