Reverse engineering a Viking VOIP phone protocol with Claude Code — Boris Starkov, Eleven Labs

Boris Starkov from ElevenLabs presents a detailed account of reverse engineering an undocumented Viking VoIP phone protocol using Claude Code, culminating in a live AI voice agent demo at AI Engineer Europe 2026. The Viking phone — a retro piece of hardware with only Windows XP-compatible configuration software — had sat unused in ElevenLabs' San Francisco office for a year after three senior software engineers and ChatGPT failed to get it working. Boris set out to crack it for a conference demo: pick up the receiver in a red phone booth on the venue's third floor and speak to a Michael Caine voice agent that quizzes users on British AI history, with ElevenLabs swag as the reward for correct answers.

The reverse engineering process unfolded in several distinct phases, all orchestrated by Claude Code. First, Claude ran an nmap scan of the phone's network ports after Boris connected it via Power over Ethernet to a router shared with his Mac. Port 1001 turned out to be a dead end (an electronics tunnel); the correct target port was identified on a subsequent scan. Claude then sent a random string and observed that the phone echoed back an 'ER' prefix plus the string, indicating an error response — revealing that the phone responds differently to valid versus invalid commands and that commands are two-letter codes.

With that insight, Claude wrote a brute-force program that iterated through all 676 possible two-letter alphanumeric combinations. Of those, 80 returned non-error responses, establishing a map of valid commands. Commands like 'SA' (plausibly 'status') gave some intuitive grounding, but most were opaque. Claude successfully used discovered commands to write SIP credentials (pointing to a Twilio trunk that would bridge the phone to ElevenLabs) into the phone's memory — but every reboot wiped the settings, because writes went only to volatile temporary memory. Attempts to find a persistence command by iterating three-letter commands and common words all failed, reproducing the same dead end that had stymied the team a year earlier.

Claude's solution was a man-in-the-middle TCP proxy. It could not bridge Wi-Fi to a Windows virtual machine (a macOS limitation), so it ran the proxy on the Mac: the proprietary Windows XP software ran in a UTM virtual machine, routed its traffic to the Mac proxy, which relayed it to the phone while logging every byte. This intercepted traffic revealed a previously unseen command 'TS' with a binary payload. Most fields were interpretable except for a one-byte checksum. Because the checksum was only a single byte, Claude reverse-engineered its formula by running known input-output pairs through candidate formulas, confirmed the pattern in a closed loop, and determined it was a simple subtraction operation — adding a fixed single-byte value. With the checksum formula solved, the full persistence sequence was understood, and the phone could be fully programmed to survive reboots.

Boris describes his own role as 'being the hands': Claude would instruct him to physically reboot the phone or count the number of beeps heard, and Boris relayed those observations back. He explicitly notes that he could not have intellectually unblocked any step — Claude was the problem-solver; he was the actuator. The total cost in API tokens was estimated at between $10 and $100 using ElevenLabs' corporate account.

The final deliverable was not just the working demo but an open-sourced Claude Code skill encoding the entire protocol, allowing anyone with a Viking phone to configure it directly without Windows software. Boris concludes that the approach is generalizable: where previously you needed the proprietary vendor interface to configure legacy hardware, Claude Code can now reverse engineer the protocol from scratch, opening up hardware hacking to engineers who are not security specialists.