What could go wrong with devices that have non replaceable batteries ?

Posted by GNUtoo on the 01 April 2020 at 1h00 under the CC-BY-3.0 OR CC-BY-4.0 license(s).

Edit1: Added forgotten link for rooting devices

Edit 2: Fixed wrong link location for rooting devices

Edit 3: Added Epilogue

In the summer 2019, in the Replicant contributors conference in Paris, the people present were all in favor of not supporting devices with battery that can't easily be replaced, because it would make the use and development of Replicant for these devices too complicated.

In subsequent conference like the FOSDEM 2020, and in discussions with other Replicant users and/or contributors, people didn't have objections to the decision.

Even if we don't want to support such devices in Replicant, we are still open to collaborate with people wanting to add support for such devices in other projects. For instance we still support the Galaxy S and the Nexus S in libsamsung-ipc while the devices are not supported anymore in Replicant, and we also do accept patches for devices we don't want to support in Repliant.

So in practice, some tablets like the Galaxy Tab 2 have battery that are not removable in the usual sense as you cannot remove the battery, without any tools, while walking, but the battery can still be replaced with the help of basic tools like tweezers and screwdrivers. In addition people don't necessarily expect tablets to last one full day. So we still intend to support such devices.

However some smartphones, which are typically used during a full day without necessarily having the ability to recharge, cannot be opened with regular tools. For such smartphones you need a heat gun, and using that also damage the device along
the way. When the battery is glued with very strong glue, it makes it even more complicated and even more dangerous to change the battery as you need to use very dangerous chemicals to remove the glue. So we decided to not support devices like that.

Given the impact of the decision (most newer phones don't have non removable batteries), even if that decision seem sound in theory, we also wanted to test it in practice, to be really sure it was the right decision.

To do that we decided to do a very quick experiment and see what would happen when adding support for a smartphone that has a non replaceable battery.

We also wanted to measure how much time was needed to add support for a device as fast as possible, because if we supported devices without a replaceable battery, we would need to rush to add support for the device while it's still being sold new in order to maximize the lifetime of the device under Replicant. Otherwise, people would need to buy the device second hand, where the battery would potentially not last a full day anymore.

Choosing a device

We didn't want to spend too much time on that experiment, so we didn't do much research and choose the first phone that would match what we were looking for.

We wanted the most recent device device with:

The device also had to be very similar to the ones we already support to spend the least amount of time possible on that experiment, so we also wanted the device to be made by Samsung, and to have a similar bootloader that is compatible with Heimdall.

So we choose a Samsung SM-N930F which meets all the requirements above. It also has an Exynos 8890, 4GiB of RAM, a stylus and runs Android 6. We wanted to have a stylus and a lot of RAM because as we didn't really intend to add official support for it in Replicant, we still wanted the work to also be potentially useful for GNU/Linux distributions that might be interested in supporting this device or similar devices:

As for Replicant, the software support for this device is very similar to the Galaxy S7 which is supported by LineageOS.

Unfortunately, the device we chose has shared memory between the modem and the system on a chip1 but as this was just for a quick experiment and that we didn't intend to add support for it in libsamsung-ipc, we just ignored that issue in order to spend the last amount of time possible.

References:

1https://github.com/RegaliaEzz/Hexa-N930F/blob/master/arch/arm64/configs/exynos8890-gracelte_defconfig

Getting the device

The first problem we had was finding the device. We started looking locally, including in second hand websites, but we didn't manage to find any. So after that we started looking in international second hand websites, and we found one.

The strange thing is that, while the device is very hard to find, there were many many offers for accessories for that device. At this stage we suspected that this was somewhat related to the non-replaceable battery, though some Galaxy S7 could still be found.

However for some reasons, even if the device was shipped, as we have proof that it was sent to the post office, we didn't receive it. We are still investigating why, but we didn't manage to get a conclusive answer yet from the shipping company as we were redirected from service to service and no one seem to know why the device didn't reach its destination. The issue is also unrelated to COVID-19 as it was shipped by the person many months before it was declared a pandemic.

So we started again to look for a device and finally found a second device. The offer was really strange. It tell that they disguised the device to look like another one to make shipping work.

This didn't surprise us, as some customs are already actively fighting against the right to repair devices1. So at the time we though it was because they decided to fight against the second hand market as well.

In that offer, the person giving the device away also had a strange request: she would not charge for the phone but she wanted us to get the data out of the phone. The person explained to us that she didn't trust nor Google nor Samsung with her data, which included private pictures but didn't manage to get her data out of the device. As the request seemed legitimate we agreed to try but as we are not expert in rooting that it might have failed. The data was not encrypted so it also would have made things easier.

References:

1https://boingboing.net/2018/10/20/louis-rossman.html

Working on the device

Working with that device was not easy. The first issue we got was that the battery would not charge at all, and the battery indication was at 0%.

This explained why the person wasn't able to extract her data from the device.

We found on XDA that it was possible to get the battery charge again if we managed to downgrade the phone OS. This looked very strange. We also learned that the phone was fusing the OS versions somewhere. This was probably in the RPMB (Replay Protected Memory Block) partition of the eMMC.

As the device was on fuse version 1, we managed to downgrade it. All that was very strange. The 0% battery charging problem seemed to be a well known issue that is supposed to only affect the the devices fused with the version 2. Maybe it was because the battery was already very discharged that it did that, and that the bootloader and OS refused to charge it.

As we didn't have a lot of time to spent on all that, we didn't want to investigate more and proceeded to download OS images for older versions of the devices. We are also not sure if this was legal or not as the images weren't hosted by Samsung, and so we don't know
if the website we downloaded them from had some arrangement with Samsung or not.

As official repair shops need to have the images, we assumed that there might be a way for websites to get the images through legal means, especially in countries that have laws that are meant to guarantee the right to repair in practice.

Extracting the data

Before downgrading the images we still wanted to try to extract the data for the person that sent us the device. So as we were unsure if installing a recovery would erase the user data, we tried to find free software root exploits for the device.

We have summarized our attempts in the RootingDevices1 page of the Replicant wiki. We still need to update it to add information about our attempts with the SM-N930F.

As we didn't find any rooting application in F-Droid, and that we didn't want to use nonfree applications to root the device, we instead started looking at vulnerabilities that enabled us to get root. For each vulnerability we looked if the kernel version of the device was affected, and if so we looked for free software versions of the exploits, that were often published without any license.

At the end we failed to find something that worked quickly so we resorted to just flashing a recovery and hoping that it would not erase the user data. According to the find command, the user files seemed to have been intact.

We then sent the ex-owner all the data, strongly encrypted with GPG, and when we got the confirmation that everything was fine we proceeded to erase all the data.

References:

1https://redmine.replicant.us/projects/replicant/wiki/RootingDevices

Working on Replicant

At this point, we found that the battery was just very old, this is why it was reporting a 0% capacity.

Each time we wanted to flash an image with Heimdall, we had to wait for hours for the device to charge a tiny bit.

The stress of the developer working on the device increased a lot because the device was potentially always on, and we didn't know when it had the ability to record conversations or not, as we didn't do a review of its freedom, privacy and security issues.

The developer's passwords could be revealed as well, by recording the noise of his keyboard, and even GPG keys can be reconstructed through noise if they are used intensively.

In order to preserve the developer's sanity and the security of the Replicant project, the device was kept in the fridge most of the time.

This was very weird for the people visiting that developer as he had to put the device in the fridge each time people came by.

Sometimes he forgot to put the device in the fridge and started to have political and/or intimate conversation and at some point he remembered the device and had to go put it in the fridge in the middle of the conversations. That was very weird. Especially the “Can you wait a second? I've to put the phone in the fridge.” part.

In addition to all these issues, we also had the device crash during development, however we couldn't wait until the battery was fully depleted as the battery didn't charge. We had to hope that the device wound not go in some mode where we were stuck. However it didn't happen, and we always managed to recover.

Then one day, around when the COVID-19 confinement started, when he was away doing some sports outside, the neighbors heard an explosion. Apparently, besides the table where it was charging and and the wall around it, nothing was damaged.

As some of the neighbors called the police, that developer was then arrested and all his equipment was seized.

He was charged with:

He plead innocent for all of the charges, and most of the charges were dismissed:

Sentences

However he was still charged with the following:

Subpoena and other declarations:

He got a suspended sentence of 3 months for all that.

Getting the equipment back

As the court was very friendly he also got all his equipment back which usually never happens. Getting it back was still very challenging but it also turned out to be very fun.

As the developer had to sign a document with all the hardware on it, to get it back, the following conversations occurred when filling the list of hardware:

Or:

Or:

Or:

Or even:

At the end the developer got it all back, and the staff said it was the strangest set of seized equipment they ever seen.

He then was unavailable during a full week, as he was reflashing all the “complicated computer hardware” for security reasons. That meant that in practice he had to reinstall Libreboot1 or other fully free versions of Coreboot that he used, Parabola2 on all the desktops, laptops, servers, single board computers and smartphones that weren't fully encrypted, reinstalling Replicant on some other smartphones and tablets, reinstalling LibreCMC3 on various devices like WiFi access points, reinstalling various microcontroller projects like frser-duino4 on his flasher, ralim/ts1005 on his soldering iron, PedRom6 on his calculator, Simrtace 1.06 on his SIM card tracer 1.07, etc

At least he could still trust his hardware and continue to use it after reinstalling everything. If the hardware had to run nonfree software, it would have been a different story.

Besides about 1 month of Apache logs, and the phone number of his contacts,
not much was exposed. We also hope that Android “Factory erase” worked fine on the SM-N930F but we can't know as we didn't try to recover any data.

The only device he didn't got back was the Samsung SM-N930F, as it was probably kept or disposed by the Justice Department.

About the lost of the device, the developer commented: “I lost weeks [of work] because of that shitty phone”, “I don't want that phone anywhere near me.”.

It turned out that, in addition to his allergy to nonfree software, freedom and privacy violations, that developer now became allergic to non-replaceable batteries as well. “Deciding to make devices with non-repleacable batteries is completely insane, it would be very important to ask ourselves how we got there.” that developer commented.

References:

1https://libreboot.org
2https://parabola.nu/
3https://librecmc.org/
4https://github.com/urjaman/frser-duino
5https://github.com/Ralim/ts100
6https://git.osmocom.org/simtrace/
7https://osmocom.org/projects/simtrace/wiki/SIMtrace

Epilogue

This blog post is a fictional political satire written by a Replicant developer for the first of April 2020. It may or may not represent the positions of the Replicant project. The story has been very strongly inspired by several real events.

Copyrights