Claude Code discovered an undocumented Viking phone protocol by scanning ports, testing commands, and brute-forcing all 676 two-letter combinations.
2
A Windows virtual machine and TCP proxy exposed the proprietary software's persistence command, including a one-byte checksum that Claude reverse engineered from known inputs and outputs.
3
The resulting protocol knowledge was open sourced as a Claude Code skill, allowing Viking phones to be configured without the original Windows XP software.
Summary
Boris Starkov explains how he connected a legacy Viking VoIP phone to an ElevenLabs voice agent without using its proprietary Windows XP software. The phone had defeated three senior engineers and ChatGPT a year earlier, partly because the ElevenLabs team used Macs and had trouble with drivers and virtual machines. Claude Code found the phone on the network, identified its communication port, tested its undocumented protocol, and brute-forced all two-letter commands. When settings disappeared after reboot, Boris and Claude ran the original software inside a Windows virtual machine and placed a TCP proxy between it and the phone. The captured traffic revealed a persistence command with a one-byte checksum. Claude derived the checksum formula from known input-output pairs and confirmed it in a closed loop. Boris then packaged the protocol as an open-source Claude Code skill. The talk also describes how he physically carried out Claude's instructions, including rebooting the phone and listening for beeps.
The phone could only be configured with obsolete Windows software
The Viking phone came with software compatible only with Windows XP. ElevenLabs engineers had Macs, and their attempts to use a virtual environment ran into driver problems. The San Francisco team bought the phone for another event and left it unused for a year after three senior software engineers and ChatGPT failed to make it work. Boris brought it to London and tried to reverse engineer the device with Claude Code instead of finding another Windows laptop.
Claude Code found the phone's network interface before decoding its protocol
Boris connected his laptop and the phone through a router. Claude Code scanned the available ports with Nmap. Port 1001 turned out to be the wrong target, an electronics tunnel, but another port accepted communication. Claude sent sequences to the phone and observed responses. A response containing 'ER' followed by the submitted string suggested an error message, which established that the device had a command protocol even though no public documentation could be found.
Claude recognized that the phone used two-letter command codes and wrote a program to try every possible pair. There were 676 combinations in total. Most produced error codes, while 80 returned something else and appeared to be valid commands. Some names suggested their purpose, such as 'SA' for status. The discovered commands allowed Boris to write calling credentials into the phone's temporary memory.
The hard part was making configuration survive a reboot
The phone accepted the credentials, but lost them whenever it restarted. Boris and Claude spent hours trying to find the persistence operation. Claude tried different commands, then searched through three-letter commands and reasonable words, without finding the answer. This was where the earlier effort had stopped. Claude then proposed running the manufacturer's software in a Windows virtual machine to observe what it sent to the phone.
A TCP proxy exposed the proprietary software's missing command
The Windows virtual machine could run the Viking software but could not bridge Wi-Fi directly to macOS. Claude set up a TCP proxy on the Mac. The Windows software connected to the proxy, the proxy relayed traffic to the phone, and it logged the exchange. This man-in-the-middle setup revealed a previously unknown 'TS' command with a binary payload. Most fields had understandable values, but one byte remained unexplained.
Claude derived the one-byte checksum from closed-loop tests
The unexplained field was only one byte, so it could be brute forced. Claude knew both the data being sent and the checksum produced by the original software. It ran known input-output pairs, inferred that the calculation was a simple subtraction involving a one-byte value, and tested more values to confirm the pattern. That closed-loop check supplied the final piece needed to save the phone's settings.
The protocol became a reusable skill instead of a Windows dependency
Once the command list and persistence sequence were known, Boris could factory reset and program the phone directly. He no longer needed the Windows virtual machine. He packaged the protocol knowledge into a Claude Code skill and open sourced it, so someone with a Viking phone can give the skill to Claude Code and configure the device without the original Windows software. Boris said the same approach could apply to other hardware with undocumented interfaces.
Boris performed the physical actions while Claude directed the investigation
Boris described his role as following Claude's instructions. Claude asked him to take the handset off the hook, listen to the beeps, reboot the phone, and control the virtual machine. Boris reported hearing three beeps, was corrected that the answer had to be two or four, and settled on two. He said Claude orchestrated the investigation while he acted as its hands. He could unblock physical steps, but could not have independently reconstructed the checksum algorithm.
