[HTC Pico (Explorer)] no.human.being:
Actually connecting the JTAG on the Wildfire S was not THAT hard, but it involves a bit of a risk.

First, you have to open the phone itself. The screws were below the battery cover. They used very small Torx screws so one needed a small Torx screwdriver to open it. Then one just pulls the the two shells apart. It requires considerable amount of force and it feels like you're certainly gonna break the case apart, but that impression is wrong. The shells will bend like crazy and feel like they're gonna snap every moment but they'll eventually separate and be fine. You only have to use this big amount of force for opening it the first time. After that, the shells will not fit that perfectly any more (though you don't actually see that when they're screwed together) and thus come off easier.

Interestingly, the Wildfire S looks (and even feels) a lot like it's made of plastic, but most is actually eloxated aluminium, especially the frame around the display is. I put some scratches into the aluminium oxide layer when separating the shells and then the aluminium will shine through. I still wonder why HTC appears to put such an effort into making the phone look like it's made of cheap plastic, when it's actually made of eloxated aluminium.

Once you have the phone open, you will find the main circuit board that is screwed to the display frame. It is held in place by several small Phillips screws. There are also two "flexible-circuit-board-type flat cables" connected to the board. Disconnect these, then remove the board.

The board has a front and a back side. On the front side, you will find these metal plates that you describe. These are used to shield the internals (processor, etc.) from the radio-frequency that the phone's wireless transmitters create. I would not suggest you to try to remove these plates. On the back side, there is really not that much. Most of it is simply covered in copper and is connected to ground. However, towards the center of the circuit board, there is an opaque black square. The black substance is actually a quite thick (compared to the coating of the rest of the circuit board) layer of insulating coating.

There is no actual JTAG "port" on the circuit board. However, there are special "JTAG adapters" (some people call them "JIGs" - don't know what that abbreviation stands for though) available for most phones (e. g. for the Wildfire S) that are circuit boards, which have sharp, spring-loaded needles attached and a standard 20-pin JTAG port. The adapter has to be pressed against the back side of the circuit board in a special alignment and then you will see that most or all of the needles hit the area where the thick insulation is. If you apply enough force, the needles will penetrate through the insulating layer and contact the signal traces below. You need to keep force on the needles to keep them connected. I did this using a pair of clothespegs. It's a bit of a hassle and will come off very easily, so I'd invite you to invent a method of pressing the needles against the board.

Since I don't have the phone anymore (and don't want to open my Galaxy Nexus to find out if it looks similar either ;) ) I cannot post photos of the circuit board. However, I attached photos of the JTAG adapter and interface and describe which pins connect to what.

On the image "jtag-adapter-top" you see the top side of the JTAG adapter. When viewed from above, the pin numbers are as follows.

...

(02) (04) (06) (08) (10) (12) (14) (16) (18) (20)

(01) (03) (05) (07) (09) (11) (13) (15) (17) (19)

The pin numbers map to the following signals.

01 = VTref

02 = Vsupply

03 = nTRST

04 = GND

05 = TDI

06 = GND

07 = TMS

08 = GND

09 = TCK

10 = GND

11 = RTCK

12 = GND

13 = TDO

14 = GND

15 = nSRST

16 = GND

17 = DBGRQ

18 = GND

19 = DBGACK

20 = GND

On the same picture (also viewed from above) you also see the needles. The two things way way down (next to the "HTC Wildfire S" imprint on the board) are not needles but just guidance posts that go through some holes in the board. Similarly, the thing way at the top a bit to the right is another guidance post. The rest are actual needles.

The needle that's above the 20-pin JTAG connector is connected to GND. The needle that's coming first below the JTAG connector (a bit to the left) is connected to RTCK. The needle that's coming a bit more down (mostly to the right) is connected to nSRST.

Then there is this cluster of five needles that are quite close together. Let's regard this cluster as two rows, a "left row" consisting of two pins in a line below each other and a "right row" consisting of three pins in a line below each other.

On the "left row", the top pin is connected to TDI, the bottom pin is connected to TMS even though that's a bit hard to tell, since the trace is routed between the solder points of the JTAG pin header.

On the "right row", the top pin is connected to TCK, the middle pin is connected to TDO and the bottom pin is connected to nTRST.

VTref, Vsupply, DBGRQ and DBGACK are not used.

When you have the board removed from the phone, you might have a hard time connecting it to the Lithium cell, since you have no battery casing any more. See here on how to emulate the WFS Lithium cell using a regulated DC power supply and a pair of resistors. It probably works for the Explorer as well.

Take a look at the "jtag-adapter-bottom" image to see how the JTAG adapter looks from below. When the JTAG adapter is attached to the board, you connect a 20-wire flat cable as in "jtag-adapter-with-cable" and attach the other end to the JTAG interface as seen in "jtag-interface".