Reverse engineering a Viking VOIP phone protocol with Claude Code — Boris Starkov, Eleven Labs

Key Concepts

• Reverse Engineering: The process of deconstructing hardware/software to understand its internal protocols and functionality without official documentation.
• Claude Code: An AI-powered coding assistant used here to automate network scanning, protocol analysis, and script generation.
• Man-in-the-Middle (MITM) Proxy: A technique used to intercept and log communication between the phone’s proprietary software and the hardware to decode the protocol.
• Checksum: A value used for data integrity; in this case, a single-byte value that was reverse-engineered to allow custom command injection.
• SIP (Session Initiation Protocol): The signaling protocol used to initiate the voice call between the phone and the Twilio/11 Labs infrastructure.
• PoE (Power over Ethernet): The physical connection method used to power and network-enable the legacy hardware.

---

1. Project Overview

The objective was to integrate a legacy "Viking" telephone into a modern AI voice agent system (11 Labs) for a summit demo. The phone, which had been sitting idle for a year due to its reliance on obsolete Windows XP software and lack of documentation, needed to be "rescued" and made to communicate with a Twilio SIP trunk.

2. Methodology: The Reverse Engineering Process

The speaker utilized Claude Code to bridge the gap between his macOS environment and the legacy hardware. The process followed these steps:

1. Network Discovery: Claude Code performed an nmap scan on the local network to identify the phone’s IP address and open ports.
2. Protocol Probing: By sending random character sequences to the identified port, the AI observed error responses (ER), confirming the existence of a command-based interface.
3. Brute-Forcing Commands: The AI iterated through all possible two-letter command combinations. It identified 80 valid commands, including status checks (SA).
4. Persistence Challenge: Initial attempts to write configuration settings to the phone failed because the data was stored in volatile memory and wiped upon reboot.
5. MITM Proxy Implementation: To solve the persistence issue, the team set up a Windows virtual machine (VM) running the phone's original software. A TCP proxy was established on the Mac to intercept and log the traffic between the VM and the phone.
6. Protocol Decoding: By analyzing the captured traffic, Claude identified a command (TS) with a binary payload and a single-byte checksum. The AI successfully reverse-engineered the checksum algorithm (a simple additive value), allowing for the injection of custom, persistent commands.

3. Key Arguments and Perspectives

• AI as an Orchestrator: The speaker emphasizes that he acted merely as the "hands" for the AI. He lacked the security engineering expertise to solve the problem, but the AI provided the intellectual framework to navigate the hardware's proprietary limitations.
• Democratizing Hardware Hacking: The speaker argues that this methodology—using AI to reverse engineer protocols—removes the need for proprietary software interfaces. This makes legacy hardware accessible to developers without specialized security backgrounds.
• Efficiency: The project, which had previously stumped three senior software engineers for a year, was completed in a matter of days using AI-assisted reverse engineering.

4. Notable Quotes

• "I'm really trying to avoid the word 'hack' that I hacked the phone. I reverse engineered it."
• "Without Claude Code, it wouldn't have been possible... it didn't just make it 10 times faster, it just made it possible."
• "I was actually like the agent for Claude. Like Claude was orchestrating the whole thing."

5. Technical Details & Data

• Hardware: Retro Viking phone.
• Infrastructure: Viking Phone → Router → Twilio (SIP Trunk) → 11 Labs AI Agent.
• Cost: The project cost was estimated between $10 and $100 in API/token usage.
• Memory: The phone contained a 256-byte memory segment that was successfully cracked to store configuration data permanently.

6. Synthesis and Conclusion

The project demonstrates a shift in how developers interact with legacy hardware. By leveraging AI to perform network reconnaissance, protocol brute-forcing, and traffic analysis, the speaker successfully bypassed the need for obsolete software environments. The final outcome—a functional, interactive AI-powered phone booth—serves as a proof-of-concept for using AI to "unlock" closed hardware systems, turning a previously unusable piece of equipment into a modern, connected interface. The speaker has open-sourced the resulting "skill," allowing others to program similar Viking phones without needing the original Windows-based software.