Forcing JTAG access when JTAG pins have been reconfigured by application

[TANDERSSON]

Is there any method to gain control of the JTAG interface if an ESP32 has been flashed with an AT firmware that is using the JTAG pins?
Ie some way to flash a new firmware which does not use the JTAG pins for other purposes.
IO0 is not accessible so it is not possible to enter the serial boot mode.

[ESP_Sprite]

Phew... that's a good question. Possibly you could force the flash pins to a certain value, disrupting the startup process so you can get a JTAG connection in?

[TANDERSSON]

@ESP_sprite. Is there a known way to access the flash pins when using a ESP Mini-1 module? The number of available pins on the affected carrier board is limited to power, EN, RX/TX, JTAG pins (IO12-IO15), IO18, IO19, IO23, IO32 and IO33.

Possibly you could force the flash pins to a certain value, disrupting the startup process so you can get a JTAG connection in?

[ESP_Sprite]

That doesn't leave many options, but there's still a few things to try.

- Possibly your AT firmware supports the sysreg command? You could use that to mux the JTAG pins back to JTAG mode.
- Last resort: It'll probably take a few ms between ESP32 startup and IO initialization. If you time a JTAG connection just right, it might be possible to get control over the chip before the AT firmware reinitializes the IO.