Prepare

Obtain https://github.com/osm0sis/mkbootimg and make.

Obtain boot.img from your device using backup-bootimg in the diagnosis mode with dpt-tools.py, or download the firmware pkg, unpack it, and obtain the latest boot.img there.

Steps

Unpack

In mkbootimg folder, unpack the boot.img:

cp <boot.img file path> ./test.img

if [[ -d test ]]; then
	rm -rf test
fi

mkdir test

./unpackbootimg -i test.img -o test

cd test

if [[ -d ramdisk ]]; then
	rm -rf ramdisk
fi

mkdir ramdisk

cd ramdisk

zcat < ../test.img-ramdisk.gz | cpio -idmv

Modify

Add adbd inside sbin/ in ./test/ramdisk/

Modify ./test/ramdisk/default.prop accordingly:

ro.secure=0
ro.adb.secure=0
ro.allow.mock.location=1
ro.debuggable=1
...
persist.sys.usb.config=acm,hid,adb
...

Repack

In mkbootimg folder, repack the boot.img:

if [[ ! -d test ]]; then
	echo "test folder not exist"
	exit 1
fi

cd test

cd ramdisk

find . | cpio -o -H newc | gzip -9 > ../test.img-ramdisk-mod.gz

cd ..

../mkbootimg \
    --kernel test.img-zImage \
    --ramdisk test.img-ramdisk-mod.gz \
    --cmdline "$(cat test.img-cmdline)" \
    --board "" \
    --base $(cat test.img-base) \
    --pagesize $(cat test.img-pagesize) \
    --kernel_offset $(cat test.img-kerneloff) \
    --ramdisk_offset $(cat test.img-ramdiskoff) \
    --second_offset $(cat test.img-secondoff) \
    --tags_offset $(cat test.img-tagsoff) \
    --header_version $(cat test.img-headerversion) \
    --hash $(cat test.img-hash) \
    -o "../test-mod-$(date +'%y%m%d-%H%M%S').img"

Flash the new boot.img

Use restore-bootimg in the diagnosis mode with dpt-tools.py

Or find a way upload the test-mod-<datetime>.img to the device, and then use:

dd if=<new boot.img file path> of=/dev/mmcblk0p8 bs=4M

If everything went smoothly, after rebooting the device, you shall be able to use adb shell to get into the device.