How to remove a permission from an apk file?

Issue

I want to remove 'SYSTEM_ALERT_WINDOW' from permissions. I created my apk file by expo-Reactnative. so I don't have access to android project directly. Now answering to one of these questions would help me alot.

1. How do I remove a permission from a raw-apk file?
2. How can I remove 'SYSTEM_ALERT_WINDOW' permission from an expo project without detaching it?

here's my app.json file from expo project:

{
"expo": {
"name": "hipotrip",
"description": "This project is really great.",
"slug": "hipotrip",
"privacy": "public",
"sdkVersion": "31.0.0",
"platforms": ["ios", "android"],
"version": "1.0.3",
"orientation": "portrait",
"icon": "./assets/icon.png",
"scheme": "hipotrip",
"splash": {
  "image": "./assets/splash.png",
  "resizeMode": "contain",
  "backgroundColor": "#ffffff"
},
"updates": {
  "fallbackToCacheTimeout": 0
},
"assetBundlePatterns": [
  "**/*"
],
"ios": {
  "bundleIdentifier": "com.berjistrip.flight",
  "supportsTablet": true,
  "buildNumber": "285"
},
"android": {
  "package": "com.hamitrip.trip360",
  "versionCode":285,
  "permissions": [
    "WRITE_CALENDAR",
    "READ_EXTERNAL_STORAGE",
    "READ_PHONE_STATE",
    "USE_FINGERPRINT",
    "VIBRATE",
    "WAKE_LOCK",
    "WRITE_EXTERNAL_STORAGE",
    "com.anddoes.launcher.permission.UPDATE_COUNT",
    "com.android.launcher.permission.INSTALL_SHORTCUT",
    "com.google.android.c2dm.permission.RECEIVE",
    "com.google.android.gms.permission.ACTIVITY_RECOGNITION",
    "com.google.android.providers.gsf.permission.READ_GSERVICES",
    "com.htc.launcher.permission.READ_SETTINGS",
    "com.htc.launcher.permission.UPDATE_SHORTCUT",
    "com.majeur.launcher.permission.UPDATE_BADGE",
    "com.sec.android.provider.badge.permission.READ",
    "com.sec.android.provider.badge.permission.WRITE",
    "com.sonyericsson.home.permission.BROADCAST_BADGE"
  ]
}

Solution

What you can do is decompile your APK using apktool, remove the permission from the manifest, increase the versionCode, optionally change the versionName as well, then recompile it still using apktool.

You will still need the original keystore that was used to sign the APK if you want to be able to upload it again to the Play Store though.

Answered By - Pierre