Arm9 target with olimex-tiny-h and openOCD

[Lenny]

Hi,

I have an  ARM926ej-s based Board with integrated FTP-Server. The system wants to read after booting a corrupted file and ends up with rebooting. So there is no time to properly interact with the board -> dead lock

I managed to connect the Olimex-Tiny-H Interface(ftdi) via JTAG and openOCD (Version 0.9; Winows 7 - 64bit). I can read external RAM (0x20000000-0x2fffffff) after the configuration through the reset init handler. Also I have a older similary firmware Hex-File, but not exact the "running" Hex-File.
There is some Boot-Code 0x000-0x61c
The Text Section is around 0x20000000-0x2004bd28
Data Section ends around 0x20052438.
If I first send "halt", then i can "reset init" (over telnet). After that, the PC shows me something like 0x2004e800, but I want to halt the system at 0x000 for setting breakpoints inside boot-section und tracing the code?
How can I do that?