RK3399 embedded Android device – need to enable ADB without working Android UI, MaskROM and direct LBA access available

[piotrbratkowski1222]

Hi,

I am trying to repurpose an EPOS EXPAND Control / DSWBT2 touch panel based on Rockchip RK3399.

The device boots its original Android-based Microsoft/Teams-style firmware, but there is no accessible Developer Options / USB debugging menu.

What I already have working:

• SoC: RK3399
• USB VID:PID in Rockchip mode: 2207:330c
• MaskROM access works
• Custom RK3399 RAM loader works
• rkdeveloptool direct LBA read/write works
• eMMC is Samsung, ~14.9 GB
• Android appears to be Android 10
• fastbootd is available
• real bootloader fastboot is available
• modified boot.img boots successfully
• dynamic super partition was successfully extracted and parsed
• system and vendor logical partitions were extracted as ext4
• direct sector modifications to system/vendor are written and verify byte-for-byte

The stock init files contain explicit support for network ADB.

In vendor init.rk30board.rc:

on property:persist.internet_adb_enable=1
    setprop service.adb.tcp.port 5555
    restart adbd

on property:persist.internet_adb_enable=0
    setprop service.adb.tcp.port 0
    restart adbd

There is also:

on property:persist.sys.adb_enable=1
    restart adbd

on property:persist.sys.adb_enable=0
    stop adbd

The system adbd binary itself contains support for:

persist.adb.tcp.port
service.adb.tcp.port
tcp:%d
adbd listening on port

I have already tried:

1. boot.img modification:
   ro.adb.secure=0
   ro.debuggable=1
   ro.force.debuggable=1
   persist.sys.usb.config=adb

2. system prop modification:
   ro.adb.secure=0
   ro.debuggable=1

3. vendor build.prop:
   persist.sys.usb.config=adb

4. disabling the vendor rule:
   persist.sys.adb_enable=0 -> changed so it no longer stops adbd

5. disabling:
   persist.internet_adb_enable=0

6. forcing from init:
   sys.usb.config=adb
   service.adb.tcp.port=5555
   start adbd

All modified sectors verify correctly after writing.

The device still boots normally, but TCP port 5555 remains closed and:

adb connect <device-ip>:5555

returns:

Connection refused

Network itself works and the device responds to ping.

The device has an ext4 userdata partition mounted as /data.
I am currently extracting userdata so I can inspect Android persistent properties.

My main questions are:

1. On this Rockchip Android build, where is
   persist.internet_adb_enable
   actually stored persistently?

2. Is editing /data/property/persistent_properties directly a valid approach?

3. Is there another Rockchip-specific persistent property store or vendor storage involved?

4. Could SELinux, property_contexts, or Android property_service reject
   persist.internet_adb_enable even if init.rc contains a trigger for it?

5. Is there a clean way to start adbd over TCP from MaskROM / Rockchip loader without already having Android ADB access?

6. Could dm-verity / AVB allow the system to boot but cause modified system/vendor init files not to be used?

The final goal is simply to get one working ADB connection so I can install an APK and repurpose the panel.

Any pointers from people familiar with RK3399 Android BSPs would be very appreciated.