Edit1: Added forgeten link for rooting devices
Edit 2: Fixed wrong link location for rooting devices
In the summer 2019, in the Replicant contributors conference in Paris, the people present were all in favor of not supporting devices with battery that can’t easily be replaced, because it would make the use and development of Replicant for these devices too complicated.
In subsequent conference like the FOSDEM 2019, and in discussions with other Replicant users and/or contributors, people didn’t have objections to the decision.
Even if we don’t want to support such devices in Replicant, we are still open to collaborate with people wanting to add support for such devices in other projects. For instance we still support the Galaxy S and the Nexus S in libsamsung-ipc while the devices are not supported anymore in Replicant, and we also do accept patches for devices we don’t want to support in Repliant.
So in practice, some tablets like the Galaxy Tab 2 have battery that are not removable in the usual sense as you cannot remove the battery, without any tools, while walking, but the battery can still be replaced with the help of basic tools like tweezers and screwdrivers. In addition people don’t necessarily expect tablets to last one full day. So we still intend to support such devices.
However some smartphones, which are typically used during a full day without necessarily having the ability to recharge, cannot be opened with regular tools. For such smartphones you need a heat gun, and using that also damage the device along
the way. When the battery is glued with very strong glue, it makes it even more complicated and even more dangerous to change the battery as you need to use very dangerous chemicals to remove the glue. So we decided to not support devices like that.
Given the impact of the decision (most newer phones don’t have non removable batteries), even if that decision seem sound in theory, we also wanted to test it in practice, to be really sure it was the right decision.
To do that we decided to do a very quick experiment and see what would happen when adding support for a smartphone that has a non replaceable battery.
We also wanted to measure how much time was needed to add support for a device as fast as possible, because if we supported devices without a replaceable battery, we would need to rush to add support for the device while it’s still being sold new in order to maximize the lifetime of the device under Replicant. Otherwise, people would need to buy the device second hand, where the battery would potentially not last a full day anymore.
Choosing a device
We didn’t want to spend too much time on that experiment, so we didn’t do much research and choose the first phone that would match what we were looking for.
We wanted the most recent device device with:
- A non replaceable battery
- An Exynos system on a chip
- Android 6
- A stylus and a big display
- A lot of RAM
The device also had to be very similar to the ones we already support to spend the least amount of time possible on that experiment, so we also wanted the device to be made by Samsung, and to have a similar bootloader that is compatible with Heimdall.
So we choose a Samsung SM-N930F which meets all the requirements above. It also has an Exynos 8890, 4GiB of RAM, a stylus and runs Android 6. We wanted to have a stylus and a lot of RAM because as we didn’t really intend to add official support for it in Replicant, we still wanted the work to also be potentially useful for GNU/Linux distributions that might be interested in supporting this device or similar devices:
- The amount of RAM and the stylus makes it more easy to run GNU/Linux
on the device:
- As the stylus is more precise than big fingers, you can more easily use software that is less well adapted to the very small display, the very high pixel density, and big fingers.
- Having 4GB of RAM should be good enough to run many common applications and desktops. It also means that the phone could be supported for a longer time if there weren’t other factors like the non-removable battery that would prevent that.
As for Replicant, the software support for this device is very similar to the Galaxy S7 which is supported by LineageOS.
Unfortunately, the device we chose has shared memory between the modem and the system on a chip but as this was just for a quick experiment and that we didn’t intend to add support for it in libsamsung-ipc, we just ignored that issue in order to spend the last amount of time possible.
Getting the device
The first problem we had was finding the device. We started looking locally, including in second hand websites, but we didn’t manage to find any. So after that we started looking in international websites second hand websites, and we found one.
The strange thing is that, while the device is very hard to find, there were many many offers for accessories for that device. At this stage we suspected that this was somewhat related to the non-replaceable battery, though some Galaxy S7 could still be found.
However for some reasons, even if the device was shipped, as we have proof that it was sent to the post office, we didn’t receive it. We are still investigating why, but we didn’t manage to get a conclusive answer yet from the shipping company as we were redirected from service to service and no one seem to know why the device didn’t reach its destination. The issue is also unrelated to Covid-19 as it was shipped by the person many months before it was declared a pandemic.
So we started again to look for a device and finally found a second device. The offer was really strange. It tell that they disguised the device to look like another one to make shipping work.
This didn’t surprise us, as some customs are already actively fighting against the right to repair devices. So at the time we though it was because they decided to fight against the second hand market as well.
In that offer, the person giving the device away also had a strange request: she would not charge for the phone but she wanted us to get the data out of the phone. The person explained to us that she didn’t trust nor Google nor Samsung with her data, which included private pictures but didn’t manage to get her data out of the device. As the request seemed legitimate we agreed to try but as we are not expert in rooting that it might have failed. The data was not encrypted so it also would have make things easier.
Working on the device
Working with that device was not easy. The first issue we got was that the battery would not charge at all, and the battery indication was at 0%.
This explained why the person wasn’t able to extract her data from the device.
We found on XDA that it was possible to get the battery charge again if we managed to downgrade the phone OS. This looked very strange. We also learned that the phone was fusing the OS versions somewhere. This was probably in the RPMB (Replay Protected Memory block) partition of the eMMC.
As the device was on fuse version 1, we managed to downgrade it. All that was very strange. The 0% battery charging problem seem to be a well known issue it is supposed to only affect the the devices fused with the version 2. Maybe it was because the battery was already very discharged that it did that, and that the bootloader and OS refused to charge it.
As we didn’t have a lot of time to spent on all that, we didn’t want to investigate more and proceeded to download OS images for older versions of the devices. We are also not sure if this was legal or not as the images weren’t hosted by Samsung, and so we don’t know
if the website we downloaded them from had some arrangement with Samsung or not.
As official repair shops need to have the images, we assumed that there might be a way for websites to get the images through legal means, especially in countries that have laws that are meant to guarantee the right to repair in practice.
Extracting the data
Before downgrading the images we still wanted to try to extract the data for the person that sent us the device. So as we were unsure if installing a recovery would erase the user data, we tried to find free software root exploits for the device.
We have summarized our attempts in the RootingDevices page of the Replicant wiki. We still need to update it to add information about our attempts with the SM-N930F.
As we didn’t find any rooting application in F-Droid, and that we didn’t want to use nonfree applications to root the device, we instead started looking at vulnerabilities that enabled us to get root. For each vulnerability we looked if the kernel version of the device was affected, and if so we looked for free software versions of the exploits, that were often published without any license.
At the end we failed to find something that worked quickly so we resorted to just flashing a recovery and hoping that it would not erase the user data. According to the find command, the user files seemed to have been intact.
We then sent the users all the data, strongly encrypted with GPG, and then when we got the confirmation that everything was find we proceeded to erase all the data.
Working on Replicant
At this point, we found that the battery was just very old, this is why it was reporting a 0% capacity.
Each time we wanted to flash an image with Heimdall, we had to wait for hours for the device to charge a tiny bit.
The stress of the developer working on the device increased a lot because the device was potentially always on, and we didn’t know when it had the ability to record conversations or not as we didn’t do a review of its freedom, privacy and security issues.
The passwords could be recorded as well by recording the noise of the keys and that even gpg keys can be reconstructed through noise if they are used intensively.
In order to preserve the developer’s sanity and the security of the Replicant project, the device was kept in the fridge most of the time.
This was very weird for the people visiting that developer as he had to put the device in the fridge each people came by.
Sometime he forgot to put the device in the fridge and started to have political and/or intimate conversation and at some point he remembered the device and had to go put it in the fridge in the middle of the conversations. That was very weird. Especially the “can you wait a second? I’ve to put the phone in the fridge.” part.
In addition to all these issues, we also had the device crash during development, however we couldn’t wait until the battery was fully depleted as the battery didn’t charge. We had to hope that the device wound not go in some mode where we were stuck. However it didn’t happen, and we always managed to recover.
Then one day, around when the Covid-19 confinement started, when he was away doing some sport outside, the neighbors eared an explosion. Apparently beside the table where it was charging and and the wall around it, nothing was damaged.
As some of the neighbors called the police, that developer was then arrested and all his equipment was seized.
He was charged with:
- the possession of an explosive device
- reverse engineering
- violation of trade secrets
- refusing to give encryption key of his hard disks,
- refusing to hand over his account details
- refusing to give his fingerprint and his DNA
- resisting arrest and insulting police officers
- destroying evidence
He plead innocent for all of the charges, and most of the charges were dismissed:
- The “explosive device” was in fact the Samsung SM-N930F, which is best knows as the Galaxy Note 7. As many other people also had one at some point, the court dismissed that charge, especially because this wasn’t done on purpose. The judge also said that they couldn’t condemn people for being stupid, not remembering about the issue, and relying on the outdated offline version of Wikipedia through Kiwix to do research on hardware.
- The reverse engineering charges were also dismissed as it was done for interoperability, and that the developer never agreed to any user license agreement that prevented that.
- Theft was quickly dismissed theft didn’t apply to the violation of copyright.
- The violation of trade secret was also dismissed, even if printed schematics were found on the developer’s table. As the schematics were published online in many forums like XDA. They were also considered as fair use. Various leaked documents like the Snowden documents, or Wikileaks revelations were also used during the case to prove that some leaked documents could be considered as fair use. The fact that the documents had “proprietary” markings was also not sufficient as many public documents also still bear markings that were just not removed.
- Counterfeiting was also dismissed because no proof of violation of copyright could ever be found, and that the use of leaked schematics was considered as fair use.
- Refusing to give encryption key of his hard disks: With a lot of pressure from many associations, this was dismissed as it was merely an excuse to get access to the developer’s data and it was not relevant to the case. The same applied with his refusal of handling any of this account data (which also includes the passwords giving access to the Replicant infrastructure).
- Destroying evidence by erasing the data of most of his computers was also dismissed. First only the boot partitions were erased and it was again not relevant to the case.
- Resisting arrest and insulting police officers: there were no proofs that this ever occurred, and rambling against non-removable battery was not deemed strong enough to constitute resisting arrest and/or insulting police officers.
However he was still charged with the following:
- Refusing to give his fingerprints
- Refusing to give his DNA: The police still got his DNA even if he refused.
Subpoena and other declarations:
- The court also gave him a subpoena “Be more careful next time and work on more constructive things like adding support for phones with a removable battery only.” to which the developer agreed.
- He also declared that rushing to add support for a phone wasn’t a good idea either, as because of that, he didn’t realize that the device was a Galaxy Note 7.
He got a suspended sentence of 3 months for all that.
Getting the equipment back
As the court was very friendly he also got all his equipment back which usually never happens. Getting it back was still very challenging but it also turned out to be very fun.
As the developer had to sign a document with all the hardware on it, to get it back, the following conversations occurred when filling the list of hardware:
- Employee: What’s this thing?
- Developer: It’s a UART adapter for smartphone, you know behind the USB connector there is [very long technical explanations]
- Employee: Let’s write “UART adapter for smartphone”
- Developer: It also probably works on tablet you know and it can also do many other things than UART like power on the phone and switch modes [very long technical explanations]
- Employee: let’s write “complicated computer hardware”
- Employee: What’s this thing?
- Developer: It’s a hardware to trace the protocol between the SIM card and the phone modem, there is a standard called terminal profile which has many privacy implications like [very long explanations]
- Employee: Let’s write “SIM card tracker”
- Developer: It can’t track SIM cards at all, but it can trace the protocol [very long explanation again]
- Employee: Sigh, let’s write “complicated computer hardware” again
- Employee: What’s this laptop? It’s a laptop, right?
- Developer: It’s a Thinkpad X200, which is a computer capable of running Libreboot, this has many freedom implications like [very long explanations]
- Employee: Let’s write “vintage computer”
- Developer: But I use that computer you know [very long explanations]
- Employee: Sigh, let’s write “complicated computer hardware” again
- Employee: What’s that? Is it a very complicated smartphone?
- Developer: It’s just a usual Galaxy Note II (GT-I9100G)
- Employee: Let’s write “Galaxy Note II”
- Developer: I’ve also a Galaxy Note II (GT-I9100) which has a very different system on a chip [very long explanations]
- Employee: Sigh, let’s write “complicated computer hardware” again
- Employee: What’s that?
- Developer: I don’t know
- Employee: You don’t know? Is it yours?
- Developer: Yes, but I don’t know how to describe what it is, you can think of it like an Arduino running GNU/Linux, back in the days before any of the single board computer had systems to automatically detect hardware [very long explanations]
- Employee: What’s an Arduino [interrupting the developer]?
- Developer: [very long explanations starting]
- Employee: Sorry [interrupting the developer], bad idea, forget about my question, let’s again write “complicated computer hardware”.
At the end the developer got it all back, and the staff said it was the strangest set of seized equipment they ever seen.
He then was unavailable during a full week, as he was reflashing all the “complicated computer hardware” for security reasons. That meant that in practice he had to reinstall Libreboot or other fully free versions of Coreboot that he used, Parabola on all the desktops, laptops, servers, single board computers and smartphones that weren’t fully encrypted, reinstalling Replicant on some other smartphones and tablet, reinstalling LibreCMC on various devices like WiFi access points, reinstalling various microcontroller projects like frser-duino on his flasher, ralim/ts100 on his soldering iron, PedRom on his calculator, Simrtace 1.0 on his SIM card tracer 1.0, etc
At least he could still trust his hardware and continue to use it after reinstalling everything. If the hardware had to run nonfree software, it would have been a different story.
Beside about 1 month of Apache logs, and the phone number of his contacts,
not much was exposed. We also hope that Android “Factory erase” worked fine on the SM-N930F but we can’t know as we didn’t try to recover any data.
The only device he didn’t got back was the Samsung SM-N930F, as it was probably kept or disposed by the Justice department.
About the lost of the device, the developer commented: “I lost weeks [of work] because of that shitty phone”, “I don’t want that phone anywhere near me.”.
It turned out that, in addition to his allergy to nonfree software, freedom and privacy violations, that developer now became allergic to non-replaceable batteries as well. “Deciding to make devices with non-repleacable batteries is completely insane, it would be very important to ask ourselves how we got there.” that developer commented.