Reverse Engineering and Cloning a S-View Flip Cover

I got a Samsung Galaxy Note 3 as soon as it was released. I wanted a S-View flip cover for it. S-View basically means the screen will automatically turn on and off when you open and close the cover. It is also able to reformat the display to show important notifications through the square viewing window of the cover, etc. The phone knows if the flip cover is opened or closed because there’s a tiny magnet inside the cover.

But all of the official S-View flip covers available are very expensive at about $60 each. The cheap covers might look like S-View covers, but they do not support the actual S-View functionality. But the cheap covers are about $5. I wanted to hack a $5 to give it S-View functionality.

With the cheap $5 cover, even if you place a magnet where the sensor is, the phone does not respond. With the official flip cover, the phone does respond to a magnet. So there is something that tells the phone whether or not an official flip cover is installed.

On the back of the phone is the cover for the battery. These flip covers replaces the original battery cover. Inside the phone are a set of spring loaded contacts, and the official S-View flip cover has two pins that connect with the contacts.

One of the contacts is ground, the other contact seems to be about 3.3V, which would make sense if there was a pull-up resistor inside. So the first thing I suspected is that the pins form a short, the phone detects the short to enable S-View functionality. I tested this, but the S-View functionality didn’t activate.

The second possibility was that the cover contained a resistor. But a resistance test showed this suspicion to be false.

So then I used my oscilloscope. It turns out there was a quick negative pulse on the pin. Once every 2 seconds. This appears to be the polling of 1-wire protocol. This meant that Samsung placed an 1-Wire ID chip into their official S-View flip covers.

So I bit the cost bullet and purchased a real S-View flip cover so I can have some fun reverse engineering the ID. I connected the signal to my logic analyzer to view the signal…

20131125_155300 (Large)20131125_155637 (Large)SONY DSC
sview_rev_eng_saleae_screenshot

… and from the waveform, I got the bits:

110011001110100101001000001100011001110000000000000001000010111011000001

… which translated into:

0x33 0x2E 0x4A 0x60 0x98 0x06 0x00 0x10 0x74 0x06

According to a DS2431 datasheet, 0x33 is the Read ROM command. “The Read ROM command allows the bus master to read the DS2431’s 8-bit family code, unique 48-bit serial number, and 8-bit CRC.”

0x2E is the family code. This doesn’t match any of the publically available family codes. So this means Samsung ordered these chips from Maxim Integrated with a customized family code. When you place such an order, Maxim also gives a set of unique 64-bit ID.

What does this mean? It is probably impossible to make your own S-View cover unless you somehow convince Maxim Integrated to break a contract with Samsung. Anybody else who can make a cover with S-View functionality probably made a deal with Samsung first, which is why they are so expensive.

But… what if I used a tiny PIC10F200T in SOT-23-6 footprint, plus a diode and capacitor, to emulate the code? Hmm… I might try that out.

19 thoughts on “Reverse Engineering and Cloning a S-View Flip Cover

  1. Chad

    Yours was the first link I clicked, and it sounds as though you are more well equipped, for the “reverse engineering”.
    Been a few months since you started working on this. Any progress?
    I have just purchased a flip cover with hopes of finding a way to do this. I assumed it would be something more simple, like a NFC tag or something.
    …in the meantime, I will continue to “perv” s-view cover links.lol

    Reply
    1. Admin Post author

      Apparently you can buy the chips with the right ID codes from various bulk sellers. Not much of a challenge to just buy the chips to bypass this. No point in continuing this project unless you need practice implementing 1-wire on a MCU.

      Reply
  2. Ummar

    Any ideas / recommendations where to get these chips? googled a bit but could not find? even a search term would help.

    Reply
  3. Stefan

    Hey Frank,

    thanks for investigating in this –
    on point to not buy this device 😉
    Sometimes i ask my self in what world i am living – manufactures integrate id chips in every thing! thats crazy! really crazy – in every batterypack / charger / powersupply / …
    in some devices i understand the idea – to verify that the device is the right one for the target – but often i think the ‘manufacture binding’ is to strict as concept – but hey thats just my opinion
    if this is going on i think we will have ID chips in every carry-bag – and you only allowed to use this bag with the products from the right super market….
    what a crazy world..

    keep up the good work 🙂
    sunny greetings
    stefan

    Reply
  4. Chillywinter

    I have been having terrible Bluetooth earphone stuttering and drop outs since I replaced my black flip cover for a white one. It took me 4 weeks to swap back the covers as I recalled my Bluetooth problem started around the same time I purchased the white flip cover. Sure enough the white cover is causing the Bluetooth drop outs. I noticed the chip easily lifts off the white case (it is only held on with double sided sticky tape, and makes no other connection with embedded coils or anything else in the back of the cover).
    I wonder what the chip is doing that is causing intermittent Bluetooth stuttering. It can occur 3 times in a minute or once every few minutes. There aren’t many contacts to resolder (there is a 6 pin chip, a diode and a resistor or capacitor on the board, making just 10 pads to resolder). I will give that a go and see if it fixes my Bluetooth intermittent drop outs. Funny how the flip cover works perfectly otherwise – so the ID code is obviously working. I’d take it back to the shop, only it was an 8 hour flight away in Singapore. It was on special for $14 so maybe a previous customer returned it already, and they were just reselling it as new. GODAMIT.

    Reply
  5. David

    Hi Franck. This small reply is just a thank you for what you share. I’m absolutely not at the level you’re playing, but thanks to this article, and Stefan’s answer, I now understand what’s going on.
    David, Paris, France.

    Reply
  6. Simo

    You should be getting more thanks for the work you have done so far.

    Hope you decide to move your research on to the next level.

    WELL DONE!

    Come on guys supprt Frank Zhao

    Reply
  7. Tlc

    I think that the easiest way would be to hack the s-view software which interprets the data from the chip by making it think that the signals received from the chip (actually no chip and no signals) are as expected.

    Reply
  8. Rakesh

    Hi,
    Asus Zenphone 5 has a similar feature which is activated by a magnet alone. The back case is not replaced and hence no contacts here. Confirmed this by bringing a magnet near the bottom left corner of the phone when no cover is present. It works!!

    I stumbled across your page while trying to figure this out for the zenphone 5.
    You have done a great work and shared it too.
    Thanks a lot.

    Reply
  9. Mahmoud Elsherif

    I have and original flip cover for Samsung Note 3. Can I take the sensor from that and put it in a fake Samsung Note 3 Neo cover??

    Reply
  10. Mrsapo

    Yeaaah!!! I just do it!
    I had the original flip cover (ruined) from the note 4 and a new (cheap) flip cover that doesn´t have the chip.
    With caution I removed the chip from the original flip cover with a slotted screwdriver. The chip is flexible so I unstuck a little from one side, then a little from the other side, then the top side, then the button side… until I unstuck it completely. The idea is to avoid flexing the chip too much and break it. My cheap flip cover had the space to place the chip, so I place it there using the remaining adhesive from the original flip cover.
    Now the SView is working again. My new and cheap flip cover already has the magnet, but I tried to fool it with a refrigerator magnet (big enough) and it also works (the sensor is at the bottom left corner of the phone).
    Hope this help to those who has both the original cover and a new cheap cover.
    And thanks to all the comments. The Idea came after reading all the comments.

    Reply
    1. jfr

      Nice job! Your post is useful! Its easy to find cheap flip cover for around 5-7 dollars. The problem with original samsung case is 1- they dont stay close 2- they lack stand for landscape usage.

      Reply
  11. jfr

    The magnet sensor is on the left capacitive bouton (recent bouton). So if you put a magnet on the cheap case on the bottom, it will work. But if the magnet touch the right capacitive bouton, it will trigger a spen removal warning. So with the correct chip, you can replicate auto sleep or sview functiona.

    Reply
  12. Rajdeep

    Hi Frank,
    I am writing from India. I have a Samsung Galaxy Note Edge and I am using an OEM Samsung Flip Cover for my phone which works brilliantly. I have often wondered how the Flip Cover works and I have googled trying to solicit views and opinions in an effort to get an answer ~ but all in vain. The results were vague and left me more confused than enlightened.
    Your article has given me deep insight on how the Flip Cover works. I wish to add that I am a novice in this line and would never venture going so much in detail trying to discover what you have unearthed. My comment posted here is not only as an appreciation for the knowledge that I have imbibed but also to let you know that your hard work has let so many people learn something from you. Thank you so much and do keep up the hard work. With my best wishes.

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *