set captive portal for Android 10 ~ 14:

export HTTP_URL=
export HTTPS_URL=
settings put global captive_portal_mode 1
settings put global captive_portal_http_url $HTTP_URL
settings put global captive_portal_https_url $HTTPS_URL

other portal servers:

http[s]://www.gstatic.com/generate_204
http[s]://dl.google.com/generate_204

captive portal server:

adb shell "settings put global captive_portal_server ip"

#for android 8
adb shell settings put global captive_portal_mode 1 #https://www.v2ex.com/t/387818
adb shell settings put global captive_portal_https_url https://www.google.cn/generate_204

enable ADB over tcp:

# first enable USB debugging
# https://stackoverflow.com/questions/2604727/how-can-i-connect-to-android-with-adb-over-tcp
su
setprop service.adb.tcp.port 5555 #-1 to disable
stop adbd
start adbd

#connect to device
adb connect ip:5555
adb shell

swap back and menu key:

/system/usr/keylayout/Generic.kl:
key 158 MENU WAKE_DROPPED
key 139 BACK WAKE_DROPPED

http://pan.baidu.com/s/1pJoKqkr
fastboot flash recovery recovery.img
fastboot boot recovery.img

• https://github.com/NVISOsecurity/MagiskTrustUserCerts