Porting Doom to a Children's Toy Camera

There are few things in the world of electronics that haven't been made to run Doom. From calculators to toothbrushes, the classic first-person shooter has found its way onto just about every device imaginable. So when Andrew Spode came across a cheap children's digital camera with an undocumented processor and less than 1 MB of available RAM, his first thought was: Can it run Doom?

The project began when Spode became curious about the firmware running on his daughter's inexpensive X9S digital camera. The device had no identifiable manufacturer, and information about its hardware was practically nonexistent. After opening the camera, he discovered an HX3302B system-on-chip (SoC) and a 4 MB flash memory chip containing its firmware.

Using an XGecu T48 programmer, Spode extracted the firmware and began reverse engineering it with Ghidra and assistance from Claude. This eventually led to the development of custom tools, including a software development kit (SDK), compiler modifications, and an emulator for testing code without repeatedly flashing the camera.

Initial experiments demonstrated that the camera's processor could execute approximately 120 million instructions per second under ideal conditions. It also had 2 MB of RAM, although only 891 KB was available for custom software. The display offered a resolution of 320×240 pixels with 256 colors.

Those specifications were enough to get Spode thinking about Doom. However, the original game was designed for computers with at least 4 MB of RAM, making memory management the biggest obstacle.

To overcome this limitation, Spode started with doomgeneric, a portable version of the game designed for unconventional hardware. He then identified unused memory regions, eventually increasing the available space to approximately 1.4 MB. Additional optimizations reduced memory fragmentation and improved how game assets were loaded from the SD card.

Another important optimization involved splitting the game's executable code between RAM and flash memory. Profiling showed that approximately 99% of execution time was spent in just 29 KB of code. By keeping these frequently executed instructions in RAM and leaving less critical routines in flash, Spode dramatically reduced memory requirements without sacrificing much performance.

The finished port runs at about 30 frames per second, complete with sound effects, 16-voice synthesized chiptune music, and the ability to save and load games. The camera's directional buttons handle movement, the shutter button fires weapons, and the power button switches between them. There were no buttons left for opening doors, so Spode came up with a hack that makes them open when the player charges at them.

Even with all of the modifications, the camera still works as a camera. Spode has since restored its original firmware and returned it to his daughter, although he plans to reinstall Doom once she's finished playing with it.