I got a Samsung Galaxy Note 3 as soon as it was released. I wanted a S-View flip cover for it. S-View basically means the screen will automatically turn on and off when you open and close the cover. It is also able to reformat the display to show important notifications through the square viewing window of the cover, etc. The phone knows if the flip cover is opened or closed because there’s a tiny magnet inside the cover.
But all of the official S-View flip covers available are very expensive at about $60 each. The cheap covers might look like S-View covers, but they do not support the actual S-View functionality. But the cheap covers are about $5. I wanted to hack a $5 to give it S-View functionality.
With the cheap $5 cover, even if you place a magnet where the sensor is, the phone does not respond. With the official flip cover, the phone does respond to a magnet. So there is something that tells the phone whether or not an official flip cover is installed.
On the back of the phone is the cover for the battery. These flip covers replaces the original battery cover. Inside the phone are a set of spring loaded contacts, and the official S-View flip cover has two pins that connect with the contacts.
One of the contacts is ground, the other contact seems to be about 3.3V, which would make sense if there was a pull-up resistor inside. So the first thing I suspected is that the pins form a short, the phone detects the short to enable S-View functionality. I tested this, but the S-View functionality didn’t activate.
The second possibility was that the cover contained a resistor. But a resistance test showed this suspicion to be false.
So then I used my oscilloscope. It turns out there was a quick negative pulse on the pin. Once every 2 seconds. This appears to be the polling of 1-wire protocol. This meant that Samsung placed an 1-Wire ID chip into their official S-View flip covers.
So I bit the cost bullet and purchased a real S-View flip cover so I can have some fun reverse engineering the ID. I connected the signal to my logic analyzer to view the signal…
… and from the waveform, I got the bits:
… which translated into:
0x33 0x2E 0x4A 0x60 0x98 0x06 0x00 0x10 0x74 0x06
According to a DS2431 datasheet, 0x33 is the Read ROM command. “The Read ROM command allows the bus master to read the DS2431’s 8-bit family code, unique 48-bit serial number, and 8-bit CRC.”
0x2E is the family code. This doesn’t match any of the publically available family codes. So this means Samsung ordered these chips from Maxim Integrated with a customized family code. When you place such an order, Maxim also gives a set of unique 64-bit ID.
What does this mean? It is probably impossible to make your own S-View cover unless you somehow convince Maxim Integrated to break a contract with Samsung. Anybody else who can make a cover with S-View functionality probably made a deal with Samsung first, which is why they are so expensive.
But… what if I used a tiny PIC10F200T in SOT-23-6 footprint, plus a diode and capacitor, to emulate the code? Hmm… I might try that out.