Dynamic analysis of Android's application layer typically relies on physical devices, limiting scalability and reproducibility. To compensate, we introduce a systematic re-hosting method that relocates the Android framework and pre-installed software from real device firmware into a fully emulated environment. Our approach integrates vendor-specific components into the Android Open Source Project (AOSP) build system using tailored extraction and injection strategies, producing vendor-flavoured emulator images that preserve system integrity and runtime compatibility. This enables dynamic execution of real-world framework and application-layer components, including proprietary binaries and pre-installed apps, across multiple SDK versions. We evaluate our method on 184 firmware samples from SDK 31-33. It achieves high build and boot success rates, with residual failures primarily occurring during core-service initialization due to baseline strategy limitations, missing dependencies, device-protection checks, or emulator constraints. However, the modular design allows injection strategies to be extended for specific firmware, supporting broader compatibility and future research on automated, adaptive re-hosting. Though we identified potential for optimization through engineering vendor-specific solutions, our research demonstrates the feasibility of vendor-flavoured emulators for scalable, reproducible dynamic analysis.

翻译：安卓应用层的动态分析通常依赖于物理设备，限制了可扩展性和可复现性。为此，我们提出一种系统化的重新承载方法，将真实设备固件中的安卓框架及预装软件移植到完全仿真的环境中。该方法通过定制化的提取与注入策略，将厂商特有组件集成到安卓开源项目（AOSP）构建系统中，生成保留系统完整性与运行时兼容性的厂商风味仿真器镜像。这使得真实框架与应用层组件（包括专有二进制文件和预装应用）能够在多个SDK版本上实现动态执行。我们在184个SDK 31-33的固件样本上评估了该方法，取得了较高的构建与启动成功率，剩余失败主要发生在核心服务初始化阶段，原因包括基线策略局限、依赖缺失、设备保护检查或仿真器限制。然而，模块化设计支持为特定固件扩展注入策略，从而提升整体兼容性，并为自动自适应重新承载的未来研究奠定基础。尽管我们认识到通过工程化厂商专用解决方案存在优化潜力，但本研究验证了厂商风味仿真器在实现可扩展、可复现动态分析方面的可行性。