Jtagging a bricked EA9500

So I've got my hands on a bricked EA9500 that previously was stuck in the known boot-loop problem. Now I still had access through CFE over serial, and I did manage to flash OpenWRT to it which worked, after fiddling around a bit with the router, the thing stopped showing anything on the serial port. This was a couple of months ago.

So today, I figured I'd give JTAG a go, something that I still don't really know much about. The device seem to have four unpopulated headers, I assume 3 of those belong to the radios as they are pretty much right next to it. I figured the one closest to the heatsink should be the one for the SoC. I seem to have managed to locate the correct pins using an Arduino Mega and JTAGenum.

I have yet to try out tjtag and a parallel port because I didn't have a system with on hand right now, I did however try a Raspberry pi port on a Raspberry Pi v1, which did not work. Next I looked at Openocd and a project on github called wifi_jtag by emard. It uses the ESP8266, I went with this because aside from a Teensy 3.2 it was the only 3.3V microcontroller I had laying around.

Now this is where I get stuck, things seems to somewhat work, I believe, as Openocd tells me tap/device found: 0x004ff17f (mfg: 0x0bf (Broadcom), part: 0x04ff, ver: 0x0. Which makes me believe it does indeed see the Soc. But at this point I really have no clue what to do yet. I'll likely give the parallel port option a try.

I'm hoping to figure this one out so we can help those who might also have a bricked EA9500 on their hands.