[HTC Wildfire S] no.human.being:
Impossible. JTAG is true low-level access. You get access to the physical address space, totally bypassing the MMU. Can't imagine how one would manage to hide anything from it. Also it's not HTC's secret. The Radio firmware is licensed from an Australian research corporation and the rest is more or less Google's code. Even HBOOT ain't really that "custom" as you make it out to be. There's a "reference design" bootloader for Android. I cannot actually remember how it was called but HBOOT sticks really close to this reference design.

Lol, just one thing that comes to mind: When we've cracked the device's security open, is anyone willing to join in creating an open-source bootloader for the device? Possibly based on UBOOT? This could actually pave the way to entirely free (as in free speech, not as in free beer) firmware for the phones.

Basically, I hope JTAG access will reveal the processor firmware that ARM Ltd. puts on the core. This firmware is what initializes the controller and loads the vendor specific firmware (Radio, HBOOT) into RAM for execution. Remember we found the procedure in HBOOT that checks the secu_flag, but it accessed an address where no useful data resided in ROM. Before HBOOT gets executed, it'll be loaded into RAM by the controller's firmware. This firmware probably loads "something" into RAM "beyond the boundaries of HBOOT" from a different ROM section before passing control to HBOOT. When we reverse-engineer what the processor does during initialization, we'll know which portion of ROM this "something" stems from. We can then dump that ROM portion and look what's inside. This "something" will probably turn out to be part of the Radio firmware. We can flip around some bits in this firmware around the address where HBOOT reads and see if the device shows up as "S-OFF" at some point. Then we'll know that we've struck the right nerve.

I really hope that the ARM architecture supports "single stepping" the processor, which basically means that you can tell it "Do a single clock cycle now!" and it'll totally halt instantly afterwards. Some architectures can do it, some don't and it would just be total awesomeness for reverse-engineering because you could literally perform every single instruction one after the other and look what it does to the processor state and RAM content. But even without that, physical memory access will be absolutely crucial since we can then be sure that there's no "hidden" things any more. The code and data we'll see through the JTAG interface will be all that's on the device. No more doubts about "what if it does this and that". Is there a piece of code in the ROM that does "this and that"? No? Then we can be sure it won't be done!

However, I'd ask you, heavy_metal_man, to get familiar with HBOOT-1.08.0099 as that's what's on my physical device (along with RADIO-7.53.39.03M) so when interacting with the device via JTAG, this will be the software we'll see. If you want to get familiar with OpenOCD (which is the software I'll be using in conjunction with the JTAG interface for on-chip debugging) see here for documentation. Please also tell me where you got the HBOOT images from. I'd love to take a look at these myself.

EDIT: JTAG adapter is ordered, but international shipping may take a while.