# Cisco CP-9951 DOOM: mapping phone input for a native game port

> Cisco CP-9951 DOOM ports the game to run on the IP phone's ARM CPU using its local framebuffer, keypad, and media path. The accompanying investigation maps the Raven keypad path and a 16-byte input event format from the phone's keyhandle module and hardware observations.

- Type: Case study
- Targets: Firmware
- Category: Independent reconstruction cases
- Relationship: Independent reconstruction project
- Sources reviewed: 2026-11-06
- Added to the catalog: 2026-11-08
- Original resource: <https://github.com/dennishilk/cisco9951-doom>
- Primary source: <https://github.com/dennishilk/cisco9951-doom/blob/f9c49115e1409d2c99de2c88f5c5c81db06cb1b8/docs/keypad-reverse-engineering.md>
- Catalog page: <https://awesomerea.org/resources/cisco-9951-doom-case/>
- Record JSON: <https://awesomerea.org/resources/cisco-9951-doom-case/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/cisco-9951-doom-case/index.md)

## Requirements & limits

- **Prerequisites:** A Cisco CP-9951 with firmware sip9951.9-2-1 is the documented tested device.
- **Testing evidence:** The author reports an Ethernet-disconnected cold-boot test of the final build.
- **License:** No licence file in the repository.

## Primary sources

1. <https://github.com/dennishilk/cisco9951-doom/blob/f9c49115e1409d2c99de2c88f5c5c81db06cb1b8/docs/keypad-reverse-engineering.md>
2. <https://github.com/dennishilk/cisco9951-doom/blob/f9c49115e1409d2c99de2c88f5c5c81db06cb1b8/README.md>

## More in Firmware and hardware

- [Zeppelin Air: reconstructing USB firmware recovery](https://awesomerea.org/resources/zeppelin-air-recovery-case/index.md) · Case study
- [EmuWorks: emulating NumWorks N0110 calculator hardware](https://awesomerea.org/resources/emuworks-case/index.md) · Case study
- [CH899: reconstructing the clock's MM32–ESP exchange](https://awesomerea.org/resources/chouchin-ch899-firmware-case/index.md) · Case study
- [telink-usb-ota: reconstructing Telink USB-HID firmware updates](https://awesomerea.org/resources/telink-usb-ota-case/index.md) · Case study
- [K2 OpenKlipper: reconstructing the Creality K2 control stack](https://awesomerea.org/resources/k2-openklipper-case/index.md) · Case study
- [ThinkCentre Fan Control: recovering fan telemetry and modes from the M70t Gen 6](https://awesomerea.org/resources/thinkcentre-fan-control-case/index.md) · Case study

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.