Using an RF signal for circuit tracing on boards with BGA devices?

[rhb]

I'm trying to sort out the header pins on a BGA Zynq based system which is not working.  In particular I want to identify the Zynq JTAG pins.

Obviously I can't do a normal continuity test.  But in considering the problem, I got to wondering if perhaps an RF signal injected at the header pins could be detected with a capacitive probe at the BGA.

The scheme I'm considering building is a 1-5 Hz pulsed 0.5 Vpp RF signal from an xtal oscillator and a synchronized pulse detector with an adjustable gain to help localize the other endpoint of the line, an electronic technician's version of an electrician's circuit breaker tracer.

The goal is to not turn on any transistor junctions so that the strongest signal is from a direct board trace and I don't cause any damage.

Obviously there are lots of complications due to coupling.  The concept of circuit tracing at RF is so nuanced that I don't even want to look at what google would suggest.  But it seems like something that might have been routine for a member of this forum.