I have an mmcblk0p2.img file that has dropbear pre-installed. It can be flashed to the mmc with fastboot. The diags "Enable USBnet" item now starts dropbear. You can SSH in after about 20 secs while dropbear starts up. You cannnot flash mmcblk0p1.img because it is too big for fastboot, but you can SSH into diags and do:
dd if=/mnt/uw/mmcblk0p1.img of=/dev/mmcblk0p1 bs=4K
You should not write to /dev/mmcblk0p1 while booted from main, and you should not write to /dev/mmcblk0p2 while booted from diags. Even reading from the device under the booted partition can create a damaged backup file, so you should boot the OTHER partition to make a backup. I have a RUNME.sh that automatically boots to diags and makes a backup of main, then reboots to main and backs up diags.
You can download the touch diags mmcblk0p2.img.gz file with SSH pre-installed here:
extract it, then install it with:
sudo ./fastboot flash diags mmbclk0p2.img