Reverse-Engineering the Mi Band 10's Unreleased Chip — Then Running DOOM On It

Xiaomi never released an SDK for the chip inside the Mi Band 10, so Aaron Christophel built one anyway, then used it to run DOOM on a fitness tracker.

What They Built

The Mi Band 10 runs on a Bestechnic BES2700iMP/BEST1503 chip with no public documentation or development tools. Christophel reverse-engineered enough of it to write working custom firmware from scratch, and demonstrated the result by porting DOOM to run on the band’s own AMOLED screen, controlled by its own touch panel.

How They Did It

The starting point was a leaked SDK for a related Bestechnic audio chip, the BES2700IHC/BEST1306, plus a separately leaked flashing tool that included the secondary-stage bootloader blobs needed to actually talk to the hardware. By cross-referencing that SDK against the Mi Band 10’s stock firmware byte by byte, Christophel mapped out the real memory layout — which turned out to be larger than documented, 1.4MB of SRAM and 4MB of flash versus the audio SDK’s stated 512KB and 2MB — along with the display and touch subsystems: a Raydium RM690B0/C0 AMOLED panel driven over QSPI, and a Hynitron CST92xx touch controller on I2C. From there, getting DOOM running meant porting GBADoom with a custom hardware glue layer, dithering the output down to RGB332 for the display, and mapping touch zones to game controls. A Python-based UART flasher built around the recovered bootloader handles getting firmware onto the device.

Why It’s Worth Your Time

This isn’t reverse engineering for its own sake — it’s a fully documented, from-nothing SDK for a chip that had none, written up clearly enough that someone else could follow the same trail on a different Bestechnic part.

Go See It

Aaron Christophel (atc1441) documented the full process on GitHub, where the README walks through the memory map, display and touch findings, the DOOM port, and the flashing process in detail. Hackaday covered the project on June 21, 2026.