Emulating the DCT3 generation of Nokia phones — the MAD2 chipset that powered the 3310, 3410, 5210 and friends. As far as I know nobody’s done a full-boot emulator for these before, so most of it had to be worked out from firmware disassembly and old scene documentation from the 2000s modding community (NokiX era — I was part of that scene as a teenager (screen name spaceimpact33), which is where the domain knowledge comes from).
There are two tracks to this: what’s live in the browser today, and hardware-in-the-loop work that currently only runs in a native harness.
In the browser (what you can try now):
ARM7TDMI core borrowed from mGBA, wrapped with the MAD2 memory map and peripherals. One catch: mGBA’s core is little-endian (GBA), while the MAD2 runs the ARM in big-endian mode — so the core needed byte-order handling throughout the memory interface to run Nokia firmware
The DSP is HLE’d. MAD2 pairs the ARM MCU with a TI C54x DSP, and firmware won’t boot without it responding correctly. The HLE is good enough to get real firmware through boot and into normal operation, though I wouldn’t claim it’s faithful beyond what firmware actually exercises
The SIM interface is emulated at the UART level — MAD2 talks to the SIM over its hardware UART, and the emulator presents as a real SIM, characterised by capturing the exchanges from an actual card
Compiles to WASM, works on mobile
Currently booting: 3310, 3410 (with J2ME), 8210, 8250, 8850/8855, 5210, 5110, 6110. The 6210/3210/7110 don’t boot yet.
Native harness only (not in the browser yet):
True C54x co-emulation using the DSP ROM4 mask ROM, which has been dumped from a 5110 (ROM6 hasn’t been dumped — hence the HLE path above). ROM4 boots with the DSP genuinely alive: keypress tones are produced by the DSP’s oscillators driving PCM output, not faked. The open problem is timing — the DSP ran at roughly 4x the ARM core clock, and getting the co-emulation timing right is impacting tone sound quality.
Dumping ROM v6 is proving difficult, TI and Nokia protected the lower mask rom from reading.
An ESP32-based SIM bridge that pipes SIM comms from the emulator to a physical SIM card, so firmware can talk to a real card
A DSP bridge (WIP) that lets the emulator drive the real DSP in a real phone — commands go over MBUS to a custom MADos build running on the handset. It works, but as you’d imagine over 9600 baud, it’s glacially slow
Honest disclosure: a lot of the implementation was AI-assisted. It’s a passion project with zero commercial value and I don’t have unlimited hours, so I used the tools that let me actually finish it. The reverse engineering and architecture calls are where the real work was.
Live: https://retro-phone.com
Source: https://github.com/djr-747/nokia-dct3-emulator
