that this method is tested on Stock Android 4.2.1 and Stock CM 12.0 (Android 5.0) , both devices having custom Recovery (ADB always enabled as default) . If your Stock Recovery allows ADB shell access then you may also consider this solution.
You should try your pattern-cracking software (or whatsoever the genre it has) from inside the Stock Recovery to see whether it works with the former's environment (ADB shell available there or not).
Since I would never try step 1., I would do the following:
For Jellybean 4.2.1:
Boot into Recovery and mount Data partition.
Open a shell on PC and type:
adb pull /data/property/persist.sys.usb.config ~/
Repace ~/ with home directory of your OS.
Open that file in a text editor and you would possibly see mtp written there. Change it to mtp,adb.
Note that sometimes Android doesn't understand the text file changes if the line terminator is "DOS Terminators" which Notepad would probably do on Windows (mine is Linux so no issue here).
In that case, I would suggest not using adb pull but doing: