Relocate and Emulate: Re-Hosting Android's Application Layer
2026-06-08 • Software Engineering
Software Engineering
AI summaryⓘ
The authors present a way to run real Android system software inside emulators instead of physical devices. They achieve this by moving device-specific parts from actual firmware into customized Android emulator builds. This lets researchers test and analyze apps and system components dynamically in a scalable and repeatable way. Their method worked well on many firmware samples, though some failures occurred due to system service start-up issues or emulator limits. The approach can be improved to support more devices and assist future automated testing efforts.
Android frameworkFirmwareEmulatorAndroid Open Source Project (AOSP)Dynamic analysisSDK versionsVendor-specific componentsPre-installed appsSystem integrityCore services
Authors
Thomas Sutter, Timo Kehrer, Bernhard Tellenbach, Marc Rennhard
Abstract
Dynamic analysis of Android's application layer typically relies on physical devices, limiting scalability and reproducibility. To compensate, we introduce a systematic re-hosting method that relocates the Android framework and pre-installed software from real device firmware into a fully emulated environment. Our approach integrates vendor-specific components into the Android Open Source Project (AOSP) build system using tailored extraction and injection strategies, producing vendor-flavoured emulator images that preserve system integrity and runtime compatibility. This enables dynamic execution of real-world framework and application-layer components, including proprietary binaries and pre-installed apps, across multiple SDK versions. We evaluate our method on 184 firmware samples from SDK 31-33. It achieves high build and boot success rates, with residual failures primarily occurring during core-service initialization due to baseline strategy limitations, missing dependencies, device-protection checks, or emulator constraints. However, the modular design allows injection strategies to be extended for specific firmware, supporting broader compatibility and future research on automated, adaptive re-hosting. Though we identified potential for optimization through engineering vendor-specific solutions, our research demonstrates the feasibility of vendor-flavoured emulators for scalable, reproducible dynamic analysis.