swap back and menu key:

/system/usr/keylayout/Generic.kl:
key 158 MENU WAKE_DROPPED
key 139 BACK WAKE_DROPPED

captive portal server:

adb shell "settings put global captive_portal_server ip"

#for android 8
adb shell settings put global captive_portal_mode 1 #https://www.v2ex.com/t/387818
adb shell settings put global captive_portal_https_url https://www.google.cn/generate_204

# worked for Android 10 ( https://wiki.orzfly.com/topics/android-captive-portal ):
settings put global captive_portal_http_url http://developers.google.cn/generate_204
settings put global captive_portal_https_url https://developers.google.cn/generate_204

#other portal servers:
http[s]://www.gstatic.com/generate_204
http[s]://dl.google.com/generate_204

enable ADB over tcp:

# first enable USB debugging
# https://stackoverflow.com/questions/2604727/how-can-i-connect-to-android-with-adb-over-tcp
su
setprop service.adb.tcp.port 5555 #-1 to disable
stop adbd
start adbd

#connect to device
adb connect ip:5555
adb shell

http://pan.baidu.com/s/1pJoKqkr
fastboot flash recovery recovery.img
fastboot boot recovery.img

• https://github.com/NVISOsecurity/MagiskTrustUserCerts