diff --git a/Full/system/bin/nanodroid-perm b/Full/system/bin/nanodroid-perm
index 08576ac3..5a516efb 100755
--- a/Full/system/bin/nanodroid-perm
+++ b/Full/system/bin/nanodroid-perm
@@ -5,6 +5,9 @@ perm_fake="android.permission.FAKE_PACKAGE_SIGNATURE"
 perm_floc="android.permission.ACCESS_FINE_LOCATION"
 perm_cloc="android.permission.ACCESS_COARSE_LOCATION"
 perm_bloc="android.permission.ACCESS_BACKGROUND_LOCATION"
+perm_phon="android.permission.READ_PHONE_STATE"
+perm_rext="android.permission.READ_EXTERNAL_STORAGE"
+perm_wext="android.permission.WRITE_EXTERNAL_STORAGE"
 perm_calr="android.permission.READ_CALENDAR"
 perm_calw="android.permission.WRITE_CALENDAR"
 perm_conr="android.permission.READ_CONTACTS"
@@ -15,6 +18,7 @@ perm_rsms="android.permission.RECEIVE_SMS"
 # Packages
 microG="com.google.android.gms"
 PlayStore="com.android.vending"
+DroidGuard="org.microg.gms.droidguard"
 GCalSync="com.google.android.syncadapters.calendar"
 GConSync="com.google.android.syncadapters.contacts"
 nlpIchnaea="org.microg.nlp.backend.ichnaea"
@@ -35,7 +39,7 @@ check_package () {
 }
 
 check_permission () {
-	[[ $(dumpsys package ${1} | grep -Eo "^[ ]+${2}: granted=true") ]] && return 0 || return 1
+	[[ $(dumpsys package ${1} | grep -Eo "^[ ]+${2}: granted=false") ]] && return 1 || return 0
 }
 
 grant_permission () {
@@ -58,8 +62,38 @@ permissions () {
 	fi
 }
 
+get_app_location () {
+	pm list packages -f ${1} | sed 's|package:\(.*\)=[^=]*|\1|g'
+}
+
+user_install_app () {
+	pm install -r ${1}
+}
+
+user_install () {
+	check_package ${1} || return
+	loc=$(get_app_location ${1})
+	case ${loc} in
+		/data/* ) echo "package ${1} already is user app" ;;
+		* )
+			user_install_app ${loc} && \
+			echo "package ${1} installed as user app" || \
+			echo "failed to install package ${1} as user app"
+		;;
+	esac
+}
+
 [[ $(whoami) = "root" ]] || [[ $(whoami) = "shell" ]] || error "not running as either ADB or root"
 
+if [ "$(getprop ro.build.version.sdk)" -ge 29 ]; then
+	# microG GmsCore needs to be installed as user app for all permissions to be granted
+	# see https://github.com/microg/android_packages_apps_GmsCore/issues/1100#issuecomment-711088518
+	user_install ${microG}
+fi
+
+# microG DroidGuard Helper needs to be installed as user app to prevent crashes
+user_install ${DroidGuard}
+
 # Fake Package Signature
 permissions ${microG} ${perm_fake}
 permissions ${PlayStore} ${perm_fake}
@@ -77,6 +111,12 @@ done
 permissions ${microG} ${perm_bloc} ${gms_uid}
 permissions ${microG} ${perm_rsms} ${gms_uid}
 
+# Misc. permissions
+permissions ${microG} ${perm_gacc}
+permissions ${microG} ${perm_phon}
+permissions ${microG} ${perm_rext}
+permissions ${microG} ${perm_wext}
+
 # Google Calendar Sync
 permissions ${GCalSync} ${perm_calr}
 permissions ${GCalSync} ${perm_calw}
diff --git a/data/service.sh b/data/service.sh
index 958c7c0a..4dd3a476 100644
--- a/data/service.sh
+++ b/data/service.sh
@@ -23,29 +23,10 @@ run_initscripts () {
 	done
 }
 
-install_gmscore () {
+run_npem () {
 	# wait until boot completed
 	until [ $(getprop sys.boot_completed). = 1. ]; do sleep 1; done
-
-	if [ $(getprop ro.system.build.version.sdk) -ge 29 ]; then
-		# microG GmsCore needs to be installed as user app for all permissions to be granted
-		# see https://github.com/microg/android_packages_apps_GmsCore/issues/1100#issuecomment-711088518
-		if [ -f "${MODDIR}/system/priv-app/GmsCore/GmsCore.apk" ]; then
-			pm list packages -f | grep -q /data.*com.google.android.gms || \
-				pm install -r "${MODDIR}/system/priv-app/GmsCore/GmsCore.apk" &
-		fi
-	fi
-}
-
-install_droidguardhelper () {
-	# wait until boot completed
-	until [ $(getprop sys.boot_completed). = 1. ]; do sleep 1; done
-
-	# microG DroidGuard Helper needs to be installed as user app to prevent crashes
-	if [ -f "${MODDIR}/system/app/DroidGuard/DroidGuard.apk" ]; then
-		pm list packages -f | grep -q /data.*org.microg.gms.droidguard || \
-			pm install -r "${MODDIR}/system/app/DroidGuard/DroidGuard.apk" &
-	fi
+	${MODDIR}/system/bin/npem
 }
 
 install_bromitewebview () {
@@ -65,13 +46,11 @@ install_bromitewebview () {
 case ${MODULE} in
 	NanoDroid )
 		run_initscripts &
-		install_droidguardhelper &
-		install_gmscore &
+		run_npem &
 	;;
 
 	NanoDroid_microG )
-		install_droidguardhelper &
-		install_gmscore &
+		run_npem &
 	;;
 
 	NanoDroid_BromiteWebView )