[HTC Wildfire S] Antagonist42:
Easiest way I can see to get around the Battery Temp sensing is essentially wire in the components, not maybe sticking to actually replicating but giving the desired results we want, replace the thermistor with resistor essentially telling it the temp is a constant .... essentially this on page 17 on the schematic would take about 5 components and would give Batt ID Temp what MSM wants to see maybe ;-)

......Just thought, could maybe place a Variable resistor in place of Thermistor to simulate heat increase/decrease so could test the system :p

Only problem I can see with giving 4Volts through the Battery connection is that PM7540 may be checking for over/under voltage and cut down or off the incoming volts/current so as to protect Battery charging/system and itself so if you can supply voltage with a power supply I'd stick to around the 3.7Volts batteries usually give out as more volts from the Battery connection could be seen as a faulty Battery.

Have you checked out this link from Olimex site? Reflashing HTC with OpenOCD Gives info for wiring and volts etc

And just in case you missed it there's this I browsed across

3.7 JTAG selection
Since both the embedded ARM microprocessor and the MSM devices have JTAG capability, the
user has the ability to select which JTAG interface they wish to use. This is done using the
MODE[1:0] pins. As previously explained, for ARM JTAG, they should be left unconnected
since they are pulled-low internally, and for MSM JTAG, pulled high externally. It is important to
remember that WDOG_EN can expire during JTAG operation, and therefore should be accounted
for, either by grounding its pins externally (thereby disabling it), or by software. Figure 3-6,
Figure 3-7, Figure 3-8 and Figure 3-9 show the example pin configurations for setting those
MODE pins.

hit a chord with this

*NOTE: OEMSPL doesn't always boot correctly when the phone is charging, thus it is recommended to leave V +5 detached or able to be detached. It is also possible to make a wire that attaches both to USB & serial.*

from here in the section HTC Serial Wire

About addressing, I came across this whilst chucking files into BinText/WinHex

Xakep Android_C6_WB_part3.bin

received OEM cmd:%s....
oemsbl..ram_test....
Starting ram test.......
Mem is 2 die 256M...Die 1 start add=0x2e00000, size=0x5200000...
Die 2 start add=0x20000000, size=0x8000000..
Mem is 2 die 512M...Die 1 start add=0x2e00000, size=0xD200000...
Die 2 start add=0x20000000, size=0x10000000.....
Mem is 1 die 256M...rebooting the device....

and this to do with JTAG from misc.img

BCM4329B1 38.4 MHz Class 1.5 LGE build for bringup board

MSM7625
TC58DYM92F2XGJ5
TC58DYM92A2XGJ5
K9K2G08R0A
KFG1G16Q2M-DEB6
KFH2G16Q2M-DEB6

bq27500..Zx2......CCIC6

NOTE THAT SOME DIAG MESSAGES ARE SENT VIA A NEW COMMAND=<cmd 146> ..YOU MUST HAVE A DIAGNOSTIC TOOL THAT SUPPORTS COMMAND=<cmd 146>,TO SEE THE NEW DIAG MESSAGES

[%d/%d].USE_HCS:%d/%d, H: %d, USE_Q: %d, PRIO: %d, q_hcs: %d, tmp_offset1/2: %d/%d, Penalty Time: %d/%d.....[%d/%d].H: %d, USE_Q: %d, PRIO: %d, q_hcs: %d, tmp_offset1/2: %d/%d, Penalty Time: %d/%d.....
...............................y.......0C..XC......... 1... 4 15:59:57 CST 2012

BCM4329B1 37.4 MHz Class 1.5 CCI Module