I got a Samsung Galaxy Note 3 as soon as it was released. I wanted a S-View flip cover for it. S-View basically means the screen will automatically turn on and off when you open and close the cover. It is also able to reformat the display to show important notifications through the square viewing window of the cover, etc. The phone knows if the flip cover is opened or closed because there’s a tiny magnet inside the cover.
But all of the official S-View flip covers available are very expensive at about $60 each. The cheap covers might look like S-View covers, but they do not support the actual S-View functionality. But the cheap covers are about $5. I wanted to hack a $5 to give it S-View functionality.
With the cheap $5 cover, even if you place a magnet where the sensor is, the phone does not respond. With the official flip cover, the phone does respond to a magnet. So there is something that tells the phone whether or not an official flip cover is installed.
On the back of the phone is the cover for the battery. These flip covers replaces the original battery cover. Inside the phone are a set of spring loaded contacts, and the official S-View flip cover has two pins that connect with the contacts.
One of the contacts is ground, the other contact seems to be about 3.3V, which would make sense if there was a pull-up resistor inside. So the first thing I suspected is that the pins form a short, the phone detects the short to enable S-View functionality. I tested this, but the S-View functionality didn’t activate.
The second possibility was that the cover contained a resistor. But a resistance test showed this suspicion to be false.
So then I used my oscilloscope. It turns out there was a quick negative pulse on the pin. Once every 2 seconds. This appears to be the polling of 1-wire protocol. This meant that Samsung placed an 1-Wire ID chip into their official S-View flip covers.
So I bit the cost bullet and purchased a real S-View flip cover so I can have some fun reverse engineering the ID. I connected the signal to my logic analyzer to view the signal…
… and from the waveform, I got the bits:
110011001110100101001000001100011001110000000000000001000010111011000001
… which translated into:
0x33 0x2E 0x4A 0x60 0x98 0x06 0x00 0x10 0x74 0x06
According to a DS2431 datasheet, 0x33 is the Read ROM command. “The Read ROM command allows the bus master to read the DS2431’s 8-bit family code, unique 48-bit serial number, and 8-bit CRC.”
0x2E is the family code. This doesn’t match any of the publically available family codes. So this means Samsung ordered these chips from Maxim Integrated with a customized family code. When you place such an order, Maxim also gives a set of unique 64-bit ID.
What does this mean? It is probably impossible to make your own S-View cover unless you somehow convince Maxim Integrated to break a contract with Samsung. Anybody else who can make a cover with S-View functionality probably made a deal with Samsung first, which is why they are so expensive.
But… what if I used a tiny PIC10F200T in SOT-23-6 footprint, plus a diode and capacitor, to emulate the code? Hmm… I might try that out.
Yours was the first link I clicked, and it sounds as though you are more well equipped, for the “reverse engineering”.
Been a few months since you started working on this. Any progress?
I have just purchased a flip cover with hopes of finding a way to do this. I assumed it would be something more simple, like a NFC tag or something.
…in the meantime, I will continue to “perv” s-view cover links.lol
Apparently you can buy the chips with the right ID codes from various bulk sellers. Not much of a challenge to just buy the chips to bypass this. No point in continuing this project unless you need practice implementing 1-wire on a MCU.
Any ideas / recommendations where to get these chips? googled a bit but could not find? even a search term would help.
A10 D8T IC Chip battery cover Sumsung GALAXY Note 3 Case Chip Auto Sleep IC
http://www.diytrade.com/china/pd/12060203/A10_D8T_IC_Chip_battery_cover_Sumsung_GALAXY_Note_3_Case_Chip_Auto_Sleep_IC.html
Hey Frank,
thanks for investigating in this –
on point to not buy this device 😉
Sometimes i ask my self in what world i am living – manufactures integrate id chips in every thing! thats crazy! really crazy – in every batterypack / charger / powersupply / …
in some devices i understand the idea – to verify that the device is the right one for the target – but often i think the ‘manufacture binding’ is to strict as concept – but hey thats just my opinion
if this is going on i think we will have ID chips in every carry-bag – and you only allowed to use this bag with the products from the right super market….
what a crazy world..
keep up the good work 🙂
sunny greetings
stefan
I have been having terrible Bluetooth earphone stuttering and drop outs since I replaced my black flip cover for a white one. It took me 4 weeks to swap back the covers as I recalled my Bluetooth problem started around the same time I purchased the white flip cover. Sure enough the white cover is causing the Bluetooth drop outs. I noticed the chip easily lifts off the white case (it is only held on with double sided sticky tape, and makes no other connection with embedded coils or anything else in the back of the cover).
I wonder what the chip is doing that is causing intermittent Bluetooth stuttering. It can occur 3 times in a minute or once every few minutes. There aren’t many contacts to resolder (there is a 6 pin chip, a diode and a resistor or capacitor on the board, making just 10 pads to resolder). I will give that a go and see if it fixes my Bluetooth intermittent drop outs. Funny how the flip cover works perfectly otherwise – so the ID code is obviously working. I’d take it back to the shop, only it was an 8 hour flight away in Singapore. It was on special for $14 so maybe a previous customer returned it already, and they were just reselling it as new. GODAMIT.
Hi Franck. This small reply is just a thank you for what you share. I’m absolutely not at the level you’re playing, but thanks to this article, and Stefan’s answer, I now understand what’s going on.
David, Paris, France.
You should be getting more thanks for the work you have done so far.
Hope you decide to move your research on to the next level.
WELL DONE!
Come on guys supprt Frank Zhao
I think that the easiest way would be to hack the s-view software which interprets the data from the chip by making it think that the signals received from the chip (actually no chip and no signals) are as expected.
Hi,
Asus Zenphone 5 has a similar feature which is activated by a magnet alone. The back case is not replaced and hence no contacts here. Confirmed this by bringing a magnet near the bottom left corner of the phone when no cover is present. It works!!
I stumbled across your page while trying to figure this out for the zenphone 5.
You have done a great work and shared it too.
Thanks a lot.
I have and original flip cover for Samsung Note 3. Can I take the sensor from that and put it in a fake Samsung Note 3 Neo cover??
Yeaaah!!! I just do it!
I had the original flip cover (ruined) from the note 4 and a new (cheap) flip cover that doesn´t have the chip.
With caution I removed the chip from the original flip cover with a slotted screwdriver. The chip is flexible so I unstuck a little from one side, then a little from the other side, then the top side, then the button side… until I unstuck it completely. The idea is to avoid flexing the chip too much and break it. My cheap flip cover had the space to place the chip, so I place it there using the remaining adhesive from the original flip cover.
Now the SView is working again. My new and cheap flip cover already has the magnet, but I tried to fool it with a refrigerator magnet (big enough) and it also works (the sensor is at the bottom left corner of the phone).
Hope this help to those who has both the original cover and a new cheap cover.
And thanks to all the comments. The Idea came after reading all the comments.
Nice job! Your post is useful! Its easy to find cheap flip cover for around 5-7 dollars. The problem with original samsung case is 1- they dont stay close 2- they lack stand for landscape usage.
The magnet sensor is on the left capacitive bouton (recent bouton). So if you put a magnet on the cheap case on the bottom, it will work. But if the magnet touch the right capacitive bouton, it will trigger a spen removal warning. So with the correct chip, you can replicate auto sleep or sview functiona.
Ho Mrsapo, can you share some pics on how you dissassembled the sview? ☺
hi,
how did you discover the Manufacturer and the Modell of the chip?
Thanks in advance,
max
only Dallas/Maxim makes 1-wire devices, it’s unique to them, so it was pretty obvious.
Here is a photo:
postimg.org/image/oa8l4ci77/
Hi Frank,
I am writing from India. I have a Samsung Galaxy Note Edge and I am using an OEM Samsung Flip Cover for my phone which works brilliantly. I have often wondered how the Flip Cover works and I have googled trying to solicit views and opinions in an effort to get an answer ~ but all in vain. The results were vague and left me more confused than enlightened.
Your article has given me deep insight on how the Flip Cover works. I wish to add that I am a novice in this line and would never venture going so much in detail trying to discover what you have unearthed. My comment posted here is not only as an appreciation for the knowledge that I have imbibed but also to let you know that your hard work has let so many people learn something from you. Thank you so much and do keep up the hard work. With my best wishes.
The link to where to buy the Chip is dead. They took it down.
Could someone post another link to purchase individual chip sensors?
I have a Note 8 and would like to integrate my current case with the trigger.
Tanx
Not sure if I understood the science behind it. So how does the samsung flip cover show the time and date? Does it use the phone’s battery?
The cover is a bit transparent. The time and date is shown on the OLED screen. Since it’s OLED, only a tiny bit of power is used in comparison to LCD.
Hello Frank
Thanks for posting, my HUAVEI P30 works with a magnet in the lower left corner.
Now I’m looking for a magnetic foil to stick in the non-smart case.
My idea without a magnet: use zoom sensor and black image of selfie camera.
Regards
Anti
Wow
The search continues for the pin-out on the note4. Instead of using an inexpensive prepacked Qi coil to circumvent the dead charging port it would be more awesome if the points on the back could be used to QC2 charge the battery inside the phone (without Qi). I fear I am limited to 5v 1.9a
Interesting that no one has tried to do this with the newer Clearview covers. For the S10 plus, I can’t find any contact pins and even the top cover does not seem to have a magnet.
I would like to transplant the active components from a working Clearview case to a cheap flip cover case. The spine has come unglued (no idea which glue works, everything I’ve tried so far lasts just a couple of days), so I’ve stuck the two pieces of the case with duct tape – looks ugly but works. I just can’t get used to a protective back only case. Please help!
Thank you for sharing your insights into reverse engineering and cloning a S View Flip Cover. It sounds like a great way to learn about the technology and create something new. We appreciate your expertise and knowledge!
Actually, I was looking for a way to demagnetize the magnet in my S-View case for the S22 Ultra. When I close the flip case, most of the apps go on pause, including YouTube. But sometimes I want to listen to YouTube videos with my earbuds with my phone in my pocket. I have not found a way to configure the phone to stay on with the cover closed. I don’t want a case with an open front because my keys would scratch up the screen, and I don’t want to buy a screen protector because they all seem to have issues with the finger print sensor. There are other flip cases without the S-view’s magnet, but they don’t have the top right opening that the S-view cases have. Hence with those other flip cases, if I fold the flip cover back, it blocks the camera.