Well thanks for the info. So still a way should be found if it is planned to be done. At least JTAG isn't exposed..Well, clock glitching - voltage glitching - radiation glitching were all tried (not by me, of course). None of them worked.
And I read that the reset line of the SoC wasn't found, so no reset glitching.
Maybe could search for those cirterias about this subject (hardware injection/corruption?) on EI or I3E.
0-T0. 1/2*T0: HALT! ? Failed >> 1/4*T0...
BTW what about the usefulness of a ARM9 customizable patch loader (from file, no need to re-compile and load it)? (forgive me asking this here)