H20 Pro RK3528 M16-R6B-L3-V1.0 bricked after writing U-Boot to eMMC - need Maskrom pins

[himigs]

Hi,

I need help identifying the Maskrom/eMMC short points for an RK3528 TV box.

Device:
- TV box sold as H20 Pro
- SoC confirmed as Rockchip RK3528
- Board marking: M16-R6B-L3-V1.0-260121
- RAM detected in Linux: 963 MiB
- eMMC detected in Linux: 7.83 GB / 7.30 GiB
- eMMC name from Linux: P1J95K
- eMMC CID: fe014e50314a39354b12739109744200

What happened:
- The box originally booted Android from eMMC.
- Armbian booted successfully from SD using a customized joilg/x88pro-based image.
- Later I wrote U-Boot/idbloader to eMMC:
  - idbloader.img at sector 64
  - u-boot.itb at sector 16384
- After reboot, the board no longer boots from SD or eMMC.
- LED stays red.
- No HDMI output.
- No Ethernet link/activity.
- RKDevTool on Windows shows "No Devices Found".

Recovery attempts:
- Tried the reset/recovery button behind the AV/P2 jack while connecting power and USB.
- Tried both USB ports.
- Tried RKDevTool v2.86 with Rockchip drivers installed.
- No Loader or Maskrom device appears.
- Tried UART pads marked GND/TX/RX using ESP32-C3 as bridge, but output is not readable.

Question:
Can anyone identify the eMMC Maskrom short point for this board?
I need to force RK3528 into Maskrom mode so I can restore the first bootloader area of the eMMC.

Attached photos:
- Front of board
- Back of board
- Macro photo of the eMMC/storage chip area
- Macro photo of test pads near the storage chip

[WINEDS]

Last photo just to the right of the rk3528 at 3 o'clock are the most likely (the two round gold pins).  With power off check with a multi meter if one of them is connected to ground.  Then with power applied use an oscilloscope to check if the other one has a clock signal on it.  If it has these are probably the maskrom pins.  Credit to @Hqnicolas

Edited 1 hour ago by WINEDS