Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces a systematic re-hosting method that relocates the Android application layer from physical devices into a fully emulated environment, enhancing scalability and reproducibility in dynamic analysis. By integrating vendor-specific components into the Android Open Source Project (AOSP) build system, the authors create emulator images that maintain system integrity and compatibility, allowing for the execution of real-world applications across multiple SDK versions. Evaluation on 184 firmware samples reveals high success rates in building and booting these emulators, despite some limitations during core-service initialization, indicating a promising avenue for future research in automated re-hosting techniques.
Vendor-flavoured emulators can achieve dynamic execution of real-world Android applications, paving the way for scalable and reproducible analysis across multiple SDK versions.
Dynamic analysis of Android's application layer typically relies on physical devices, limiting scalability and reproducibility. To compensate, we introduce a systematic re-hosting method that relocates the Android framework and pre-installed software from real device firmware into a fully emulated environment. Our approach integrates vendor-specific components into the Android Open Source Project (AOSP) build system using tailored extraction and injection strategies, producing vendor-flavoured emulator images that preserve system integrity and runtime compatibility. This enables dynamic execution of real-world framework and application-layer components, including proprietary binaries and pre-installed apps, across multiple SDK versions. We evaluate our method on 184 firmware samples from SDK 31-33. It achieves high build and boot success rates, with residual failures primarily occurring during core-service initialization due to baseline strategy limitations, missing dependencies, device-protection checks, or emulator constraints. However, the modular design allows injection strategies to be extended for specific firmware, supporting broader compatibility and future research on automated, adaptive re-hosting. Though we identified potential for optimization through engineering vendor-specific solutions, our research demonstrates the feasibility of vendor-flavoured emulators for scalable, reproducible dynamic analysis.