Yes, Doom Now Runs on a Toy Video Walkie-Talkie
Now Doom runs on video walkie-talkies, thanks to Aaron Christophel's reverse engineering work. Over and out, demons!
As someone who loves to reverse engineer and hack hardware of all descriptions, Aaron Christophel has got a lot of unusual gadgets lying around his workshop. Lately he has been digging into the operation of a cheap-yet-super-cool video walkie-talkie toy. This walkie-talkie naturally has a display, so it's easy to see where this is headed. That’s right: Christophel got it to run Doom.
The walkie-talkie may be a toy, but under the plastic shell Christophel found some reasonably capable hardware built around a mysterious multimedia chip called the TXW818. According to his reverse engineering work, the processor is roughly comparable to an ESP32 in capability, but uses a different 32-bit architecture more commonly found in ultra-cheap Chinese IoT products.
Two hardware versions of the walkie-talkie were examined. The cheaper model came equipped with 2 MB of external SPI flash storage and a 650 mAh battery, while the upgraded variant doubled the flash memory to 4 MB and increased battery capacity to 800 mAh. Both versions also include a small LCD display, a camera, microphone, speaker, and custom wireless hardware for peer-to-peer communication over 2.4 GHz frequencies.
On the more advanced model, the manufacturer had physically laser-etched away identifying marks from the chips to make reverse engineering harder. The firmware also employed hardware-level scrambling on the SPI flash bus, causing extracted data dumps to appear as meaningless garbage unless decoded by the SoC in real time.
Christophel bypassed these protections with a combination of hardware probing, firmware analysis, and fault injection techniques. After locating hidden debug pads behind the LCD connector, he connected a custom programmer based on a cheap STM32 “Blue Pill” development board. The biggest problem at this point was the stock bootloader, which immediately disabled the debugging interface during startup.
To defeat that protection, Christophel intentionally corrupted the boot process by shorting the SPI flash lines with tweezers while powering on the device. The glitch prevented the firmware from executing correctly, leaving the processor stalled in a safe state with the debug interface still active. From there, he was able to flash his own custom firmware directly onto the device.
Running Doom on this constrained platform still took some work, however. The complete game and engine required roughly 1.4 MB of storage space, which barely fit on the cheaper hardware variant. Christophel solved the issue by compressing the game assets into a 500 KB package stored in flash memory, then decompressing everything into the chip’s 4 MB of onboard PSRAM during boot.
If you’re going to hack something, you may as well go all out. Christophel certainly did by hacking the firmware to replace Doomguy’s classic status-bar face with a live feed from the device’s built-in camera. That means players can watch their own facial expressions while fighting demons on their toy walkie-talkie.