My Fold6 Inner Screen Broke, So I Locked It to the Cover

My Galaxy Z Fold6's inner screen broke. Not a cracked corner or a dead line of pixels: the big middle display is gone and its cables are cut. That turned out to be worse than it sounds. Every time I unfolded the phone, Android did what it is designed to do. It turned off the cover screen and moved everything to the inner display, which now just shows black. Open the phone and it is effectively switched off.

The cover screen still works perfectly, though, and a Fold that can bend is genuinely useful even without its main panel. Opened into an L shape it is a tripod for photos and video, a desk stand for calls, or a little monitor for recording. So the goal was simple: keep the cover screen on no matter what the hinge is doing, and never hand the display over to the broken inner panel. No root, no flashing, and it has to survive a reboot.

How a Fold decides which screen to use

Foldables have a system service called device_state. It reads the hinge angle sensor and the lid switch and publishes a posture: CLOSED, TENT, HALF_OPENED, OPENED and two concurrent dual-screen modes. The window manager then maps each posture to a display. CLOSED means the cover screen, OPENED means the inner screen. You can see all of it over adb:

adb shell cmd device_state print-states
# 0 CLOSED, 1 TENT, 2 HALF_OPENED, 3 OPENED,
# 4 CONCURRENT_INNER_DEFAULT, 5 CONCURRENT_OUTER_DEFAULT

adb shell dumpsys device_state | grep -E "mCommittedState|mBaseState|Override"

The important detail is the difference between the base state (what the sensors say) and the committed state (what the phone acts on). Android lets privileged callers, including the adb shell user, request an override. If you override the posture to CLOSED, the phone keeps using the cover screen even when the sensors say it is fully open.

adb shell cmd device_state state 0      # force CLOSED -> cover screen
adb shell cmd device_state state reset  # give control back to the hinge

I ran that, unfolded the phone, and the cover screen stayed on. The dumpsys output showed exactly what I wanted: mBaseState=OPENED, mCommittedState=CLOSED, override active. Problem solved, for about two minutes.

Why a one-off adb command is not enough

The override broke in two ways. The obvious one is that it lives in memory and is gone after a reboot. The sneaky one only shows up in logcat: every time the lid switch reports "closed", Samsung's FlexibleDeviceStatePolicy cancels any active override. So you open the phone and it works, close it, open it again and you are back to a black inner screen.

So the fix needs a watcher: something running as the shell user that reapplies the override whenever Samsung drops it. The lid switch is an ordinary Linux input device (named "flip" on the Fold6, reporting SW_LID), and the shell user can read input events with getevent. That gives an event-driven trigger, with a slow poll as a backup:

#!/system/bin/sh
# coverlock.sh - runs as the adb shell user
apply()  { cmd device_state state 0 >/dev/null 2>&1; }
active() { dumpsys device_state | grep -q "Override Request active: true"; }

# find the input device that reports SW_LID (event numbers change between boots)
LID_DEV=$(getevent -pl 2>/dev/null | awk '/^add device/{dev=$4} /SW_LID/{print dev; exit}')

apply
( getevent -l "$LID_DEV" | while read -r _ type code val; do
    [ "$code" = "SW_LID" ] && { sleep 0.3; apply; }
  done ) &

while true; do active || apply; sleep 2; done

Started with nohup setsid from adb, the watcher keeps running after the USB cable comes out. Fold, unfold, lock, unlock: the cover screen stays on every time.

Surviving a reboot without a PC

Without root, an app can't get shell-user rights on its own at boot. Something has to start an adb session. Shizuku does exactly that: it uses Wireless Debugging to start a small server running as the shell user, and other apps can then run commands through it. Its terminal helper, rish, gives you a shell with uid 2000.

The catch is that the official Shizuku 13.6 can't start on boot without root; after every reboot you have to start it by hand. The community fork by thedjchi adds a start-on-boot mode that waits for Wi-Fi, turns on Wireless Debugging using the WRITE_SECURE_SETTINGS permission, and starts the server. The chain at boot becomes:

• Phone boots and you unlock it on Wi-Fi
• Shizuku (thedjchi fork) starts itself through Wireless Debugging
• Termux runs ~/.termux/boot/coverlock, which waits until rish answers as uid 2000
• rish launches coverlock.sh as the shell user, and the cover screen is locked again

#!/data/data/com.termux/files/usr/bin/sh
# ~/.termux/boot/coverlock
rish() { RISH_APPLICATION_ID=com.termux /system/bin/app_process -Djava.class.path=$HOME/.rish/rish_shizuku.dex /system/bin --nice-name=rish rikka.shizuku.shell.ShizukuShellLoader "$@"; }

for i in $(seq 1 180); do
  if rish -c 'id' 2>/dev/null | grep -q "uid=2000"; then
    rish -c 'ps -A -o ARGS | grep -q "^sh /data/local/tmp/coverlock.sh" || (nohup setsid sh /data/local/tmp/coverlock.sh </dev/null >/dev/null 2>&1 &)'
    exit 0
  fi
  sleep 5
done

On the final test reboot the watcher was running about 60 seconds after boot with no cable attached: Shizuku up, override active, cover screen on.

The gotchas that ate my afternoon

• Apps can't read /data/local/tmp. SELinux blocks untrusted apps from shell-owned files, so Termux got "access denied". The fix was to stage files in /sdcard/Download/fold6 and copy them into Termux's private home.
• Play Store Termux refuses #!/system/bin/sh scripts ("unable to open /system/bin/sh"), so the stock rish wrapper fails. Calling ShizukuShellLoader directly through app_process works.
• Android 14+ refuses to load a writable dex, so rish_shizuku.dex has to be chmod 400 inside Termux's own storage.
• Shizuku's start-on-boot switch only appears after Shizuku has been started through Wireless Debugging at least once. If you started it over USB, it counts as PC mode and the switch stays hidden.
• pgrep -f and pkill -f can match their own command line. My boot script decided the watcher was "already running" because the check itself contained the word coverlock.sh. Anchored patterns such as ^sh /data/local/tmp/coverlock[.]sh fix it.
• The fork and the official Shizuku share a package name but not a signing key, so you have to uninstall one before installing the other.

What the broken Fold is good for now

With the inner screen out of the picture, the hinge has become the best feature. Half-open on a table, the phone is a self-standing camera: frame shots on the cover screen and use the main cameras for photos, timelapses or video without a tripod. It props up for video calls and screen recordings, and it can stand on a desk as a dashboard or media player. Open or closed, it behaves like a normal phone with one good screen.

Try it on your Fold

git clone https://github.com/adgsenpai/fold6-cover-screen-lock
cd fold6-cover-screen-lock
./install.sh                     # cover screen locked until the next reboot

# for autostart: install the thedjchi Shizuku fork + Termux, pair Shizuku once
# over Wireless Debugging, enable "Start on boot", re-run ./install.sh, then in Termux:
sh /sdcard/Download/fold6/setup-termux.sh

I tested it on a Fold6 (SM-F956B) running Android 16. Other Folds expose the same device_state service, so it should carry over, though Samsung may name the hinge input device differently. That's why the script looks it up instead of guessing.