Dynamically executing specific target methods in Android applications remains a critical and unresolved challenge. Despite notable advancements in GUI testing, current tools are insufficient for reliably driving execution toward specific target methods. To address this challenge, we present GAPS (Graph-based Automated Path Synthesizer), the first system that leverages static, method-guided call graph reconstruction to guide the dynamic, interaction-driven execution of an Android app. GAPS performs a lightweight backward traversal of the call graph, guided by data-flow analysis, to reconstruct paths reaching the target methods. These paths are then translated into instructions that guide runtime app exploration. On the AndroTest benchmark, GAPS statically identifies paths towards 88.24% of the target methods, averaging just 4.27 seconds per app, and reaching 57.44% of them through dynamic analysis. This performance exceeds the state-of-the-art tools' one: the model-based GUI tester APE reaches only 12.82%, the hybrid tool GoalExplorer reaches 9.69%, and the LLM-based Guardian reaches 17.12%. Finally, we applied GAPS to the 50 most downloaded apps from the Google Play Store, achieving an average static analysis time of 278.9 seconds to reconstruct paths towards 62.03% of the target methods and reaching 59.86% of them through dynamic analysis.

翻译：在Android应用中动态执行特定目标方法仍是一个关键且尚未解决的挑战。尽管GUI测试领域取得了显著进展，但现有工具仍无法可靠地将执行驱动至特定目标方法。为应对这一挑战，我们提出了GAPS（基于图的自动化路径合成器），这是首个利用静态的、方法引导的调用图重构来指导Android应用动态交互驱动执行的系统。GAPS通过数据流分析引导，对调用图进行轻量级逆向遍历，以重构到达目标方法的路径。这些路径随后被转化为指导运行时应用探索的指令。在AndroTest基准测试中，GAPS静态识别出通往88.24%目标方法的路径，平均每个应用仅需4.27秒，并通过动态分析成功抵达其中57.44%的目标方法。这一性能超越了现有最先进工具：基于模型的GUI测试工具APE仅达到12.82%，混合工具GoalExplorer达到9.69%，基于LLM的Guardian达到17.12%。最后，我们将GAPS应用于Google Play商店下载量最高的50款应用，平均静态分析时间为278.9秒，成功重构了通往62.03%目标方法的路径，并通过动态分析抵达了其中59.86%的目标方法。