Baseband JTAG

The old baseband has a JTAG port, and it's highly likely the new one does too.

Credit
geohot

Feasibility
Currently the JTAG protocol isn't known. And the baseband appears to lock down JTAG.

Implementation
Infineon Jtagger