This guide is based on this guide by Danila Romanov

Decompiling framework.jar

1. Install JADX
2. Get a copy of /system/framework/framework.jar from the target device
3. Unzip the jar file
4. Run the JADX CLI on classes.dex, or open the file in the JADX GUI
5. Navigate to android/content/pm/IPackageManager.java
6. Find the value of TRANSACTION_setSystemAppInstallState
   • It should look something like this: static final int TRANSACTION_setSystemAppInstallState = 136;

Removing the app

Run the ADB command:

adb shell service call package <value> s16 <package> i32 0 i32 0

You should get the result:

Parcel(00000000 00000001 '........')