[HTC Pico (Explorer)] no.human.being:
Ok, first you have read the WFS thread so you know that JTAGging the WFS was not an easy task (actually it didn't work at all, but we got around a lot of obstacles).

You'll have to open it (on the WFS you need a very small torx screwdriver and a very small Phillips screwdriver for this), strip all peripherals off the board (including the battery housing). Of course this also means that you cannot see what the phone does on the screen anymore, unless you somehow manage to leave the screen connected (might be hard or impossible).

The phone won't boot without a Lithium cell emulation. So just to power it up, you already got to have a regulated DC supply at 4.0 V and four clamps on the circuit board (one for ground, one for Vcc voltage supply, two for the "thermistor emulation"). I have very small clamps and it was very hard to contact the WFS board with them, they came loose and then the board crashed or something like that. Standard-sized clamps wouldn't have worked without shorting out everything on the board.

Then you have to get the JTAG on. This requires a JTAG interface first. What this does is provide the proper signalling. It has a USB connector on one side to connect to the debugging host (computer) and a 20-pin male JTAG connector on the other side. Into this goes a flat cable (a lot like an old IDE/PATA hard drive data cable, but half as wide) with two 20-pin female JTAG connectors on each side.

However, the phone won't have such a connector on the board, because it's too large. In fact it has no "official" JTAG connection at all. There are conductive copper traces on the board that carry the JTAG signal though. The JTAG adapter itself is also a circuit board and it has sharp spring-loaded needles that will penetrate the insulation that's on the top layer (phone boards are multi layer boards so they have "hidden" traces that go along the "inside" of the circuit board as well and are inaccessible from the outside so be careful when handling a circuit board - there's a lot of stuff that you cannot see at all but that's very important) copper traces of the phone's circuit board to contact these traces.

On the Wildfire S adapter, the needle that contacted the "ground" trace was not sharp like the rest, but rounded, so it did not penetrate the insulation layer that was on the ground trace. As long as the ground connection was missing, OpenOCD claimed "processor returns all ones". I used some fiberglass to grind off the insulation on the ground trace in the place where the needle of the JTAG adapter goes. Afterwards, the ground connection was ok and I verified that communication between the interface and the processor works using an oscilloscope on the JTAG adapter's pin header. The JTAG adapter needs to be pressed against the phone's circuit board with considerable force during debugging, so that the needles keep up a good electrical connection. I used two clothespegs for this job.

Now all in all you can imagine that the setup is not easy. You have the board out of the phone, then four clamps on the board to provide power and "emulate the thermistors" of the Lithium cell, two of them to a regulated DC power supply, four of them to resistors (resistance values must be in a very narrow band for the board to boot properly) emulating the thermistors, the JTAG adapter pressed against the circuit board using two clothespegs on either side, oscilloscope ground and probes on the JTAG adapter, the JTAG adapter connected to the JTAG interface using a flatband cable, JTAG adapter connected to debugging host using a USB cable. Things get messy very soon and as soon as you touch anything, a cable will drop off and you lose connection and have to take the power off the board and start over again. It's really not for the faint of heart.

And then you realize that the processor's logic voltage is too low and you need an additional level-shifting circuit between the JTAG adapter and the JTAG interface. :D

And this was all just hardware stuff. Once you got the signalling right, you have to make sure OpenOCD is configured correctly so that it works with the processor. I've taken some values from ARM data sheets and some have been "educated guesses", I'm not sure how close this config is to actually debugging an MSM7227 (which is actually an ARM1136JS - ARM designs these things and then a lot of manufacturers manufacture them - MSM7227 is a manufacturer-specific model number from Qualcomm, ARM1136JS is the processor design by ARM that it implements). The config is written in a complete scripting language called LUA, so you can do very complex stuff with it, but my configuration was just some basic "key-value pairs".

So, like I said, the MSM7227 is actually an ARM1136JS, the MSM7225A is an ARM Cortex A5 by the way.

Well, since I've never got far enough to see the actual debugger shell on OpenOCD (it won't provide any debugging commands unless connection to the processor has been successfully established) I don't know how hard it is to debug etc. Now you can say, how hard can it be to operate a debugger, but if someone has ever worked with gdb (the GNU debugger) then he knows how f*cking complicated and "impossible to operate" a debugger can be. (Sorry, GNU people, most of your software is fantastic, but there are some utilities that I never managed to understand one of these is "gdb". As far as I know, most of "gdb" isn't even documented, since even the devs don't understand some of their stuff any more. This might be an urban legend though. Same legend exists about the "vi" utility from the BSD devs. :D )

Don't know. I've moved on to a Samsung phone and I have full write access to the entire storage. No "hidden" or "protected" stuff. I don't tinker around with most "chipset-specific" firmware though (only flash official updates for chipset-specific stuff from time to time and the "higher level" firmware is custom). :D