Reverse engineering a Viking VOIP phone protocol with Claude Code — Boris Starkov, Eleven Labs

Hi everyone, thank you for coming even though there is lunch being served now. Really appreciate you coming here. Um, I'm Boris, I work for ElevenLabs. Usually we do agents, voice agents, um, like all things voice. But for this chat, I just wanted to show you something else.

Um, you might have seen, if you've been on the third floor, you might have seen this phone booth. This is Swix, by the way, the organizer. Um, uh, they've built it as a, as a demo, um, demo for this summit.

There is this phone inside. Um, and I don't know how many of you have went through it. Did anyone? You should totally give it a try. Oh my god. Okay. But, uh, the idea is that when you pick it up, you actually end up talking to an AI agent, uh, with a Michael Caine's voice, uh, approved, um, legal, who, who then walks you through five questions about British AI history.

And then if you answer at least one of them, you can get a swag from, from ElevenLabs. So that's the idea. But, uh, today I want to show you how I actually build it. So this is how it looks like now.

And this is how it looked like last week. This is the, um, old I mean, it's not that old. It still has a, a controller inside. But it's a quite old piece of hardware, this phone. And the main problem when we tried to make this happen, the main problem with the, this piece of hardware was that, um, it only had a Windows, Windows XP compatible, uh, software.

So it was very hard to set it up. Because it turned out that nobody at ElevenLabs has a Windows, uh, laptop. Uh, we all had Macs. But also, when we tried to set up, like, a virtual environment, it also had some driver issues.

So, uh, what happened to this phone, uh, our team in San Francisco purchased it one year ago for some other event. And three software engineers, three senior software engineers, and a Claude—uh, sorry, ChatGPT at the time, they couldn't figure out how to make it work.

So it was just for one year, it was just laying there, uh, waiting for, waiting to be rescued. And, um, for this project, we, we, we asked them to send it to, to London. Um, and, um, then I tried to crack it, hack it, reverse engineer it using Claude Code.

And this is what I wanted to talk about. How to use Claude Code, not just to build, uh, applications, but how to use it to actually, like, uh, reverse engineer some hardware. So, by the way, these slides are fully, fully made by Claude Code as well.

So I the way I made them is I, um, put the whole conversation we had about this, um, process, and then asked it to, as a context, and then asked it to make slides based on that. So the goal here, uh, what we want to achieve is, uh, we have this Viking phone, the, uh, retro legacy Viking phone, and we want to connect it to a conversational AI agent by ElevenLabs.

Uh, it can only make a phone call to a phone number, so we need to put Twilio in between, just, um, to handle that SIP, SIP domain complexity. So it goes Viking phone, then Twilio, then ElevenLabs. Um, yeah.

The problem? I have a Mac. Uh, so we couldn't really, like, easily set it up. Uh, so what we ended up doing, what I ended up doing instead, I, uh, connected the connected, uh, my laptop to the phone by a router and, uh, started, uh, exploring.

I mean, by saying I started exploring, uh, Claude Code started exploring it. So first, it, um, unmapped all of the ports that were available. Uh, so port 1001, um, which tur-turned out to be the wrong one. It was just, uh, Lotronics tunnel.

Uh, then it proceeded to iterate, and the next one was the actual, uh, target port that could be used to communicate with the phone. So step one, Claude Code found the way to communicate with the phone. Um, then, uh, then it started discovering it.

So it sent, um, some random sequence. I mean, not random Viking, but just random sequence, um, to the phone. And the phone responded. So that's how Claude Code realized that, um, that this is an actual interface, a protocol.

But the protocol is not, like, googlable. You can't there is no open documentation on what the exact protocol is. So it had to then, um, reverse engineer it,right? So first thing Claude noticed is that when you send a random string to the phone, it returns, uh, this er and then the string itself.

Meaning likely it's an error, error that this string is not a correct command for the phone. So next, um,

yeah. Next, Claude figured out those commands that, um,

that this, uh, this phone, it operates using two-letter commands, command codes. Um, some of them are nonexistent, then, um, it returns an error, like on this slide. Other, however, they return something else. Um, the next idea was that actually, if it's two-letter commands, then we can just iterate through all of them,right?

Uh, brute forcing. So it, uh, wrote, uh, this, this program and, uh, literally, like, tried out every single combination of two letters. Um, and it turned out that most of them returned error codes, but 80 of them returned actual, like, something else, meaning they're actual valid commands.

Uh, those were some of them.

By the way, I'm not sure

okay, I'm not sure what this is, but, uh, yeah. Then it, uh, then it, uh, some of the commands, they kind of made sense based on the on, on the name. Uh, maybe not those ones, but for example, uh, SA for status kind of makes sense.

I don't know if it makes sense. Yeah. Uh, then, uh, then it proceeded to try to set up the actual credentials on the phone. So this is, this is, uh, this is the phone memory. And it basically what we're trying to do here is to put theright credentials to the phone memory so that it knows where to call.

We want to call Twilio or Sigtrong,right? Um, and it turned out that, yes, these commands, they worked, and, uh, all of the settings got accepted. But the problem is, the moment the phone got rebooted, they all were gone.

So

they were not saved in the memory. They were just wrote to the temporary memory. And then, uh, we started me and Claude Code, we started, like, a multi-hour operation of trying to figure out how to actually save what you put to the put to this, like, temporary memory, how to make it actually, um, persistent, like, how to save it to the long-term memory of the phone.

It tried everything. It tried different commands. Then it I don't know if the slides are gonna show this, but it tried three-letter commands. It iterated over all three-letter commands, over all reasonable words, and it didn't find anything.

Uh, so this was the dead end situation. This was around the place where, uh, our team in San Francisco, when we just started, um, exploring it the first time, um,

they, they could they couldn't figure out what to do next. But that was one year ago when, um, there was only ChatGPT. Now with Claude, Claude didn't give up at this point. Claude suggested that, uh, there is a yeah.

Claude figured, figured out the problem, and then it suggested a solution. So the solution at this, uh, step was, was to set up a Windows virtual machine. However, uh, the main problem with, with Windows virtual machine is that you can't bridge Wi-Fi, uh, to macOS.

So there is no internet connection in the Windows virtual machine. So what Claude did next was actually a very smart thing. It set up a TCP proxy on the Mac so that the, uh, traffic from the virtual machine oh, why are we setting up virtual machine?

Because in the virtual in the Windows virtual machine, we can set we can, um, run the software of this phone that actually knows how to communicate with it. So the solution, uh, so what we are trying to do now, we are trying to, uh, put, like, a meat-in-the-middle attack, kind of, to intercept the traffic between the software and the phone, to analyze it, and to figure out how, how it communicates, how it works.

So the software is running in Windows virtual machine now. Then it, it's directed, it communicates to the proxy on my Mac. The proxy is relaying it to the Viking phone, but also it logs everything so that to figure out what they're talking about and what's the protocol is, what are the what is the missing piece.

Um, very simple code. And then, yeah, then it started capturing the communication. And it, uh, figured out that there was this command that, uh, that, uh, Claude didn't understand before, which is TS, uh, which had, like, some weird binary payload.

And then

that had, like, this format.

And what you can see here is most of the most of the params of this, uh, command, they kind of make sense, except for the checksum. But checksum turned out to be only, uh, one byte. So it's something that you can brute force as well.

Um,right.

Yeah. Uh, so the way it, uh, it worked, it doesn't know the checksum, but it knows which data is being sent, and it knows the result. So it can, uh, easily reverse engineer the, the encryption protocol, which is just which turned out to be just adding a, a

yeah. Basically doing a simple subtraction, like, adding a simp a simple one-byte value, uh, to the checksum. It not just Claude Code. I want to highlight it. Claude Code didn't just figure out what the, um, format of the checksum is.

It actually, like, managed to find it, and then it confirmed it, uh, by running, uh, by running more values through it. So it, it was kind of, like, closed-loop iteration. Um, and at this point, the phone was pretty much cracked.

Uh, so now we managed to figure out how the software communicated to the phone. And, uh, we had the list of commands, and we what was that?

Yeah. And then, uh, we figured out how to actually the, the problem I stated in the beginning, how to actually, uh, save what you what you put to the memory. We need, um, this, uh, to run this sequence of commands.

Um, and the last one, uh, the fun bit was that actually there is this, uh, 256 bytes, um, memory in the phone, which, uh, it also happened to crack. Um,

and then the, the last bit the last bit of this, uh, process was that actually I didn't want to run Windows, uh, virtual machine every time. So the last bit was actually, uh, now when I know the protocol, I know how to talk to the phone.

I can just factory reset it, and now I can use this skill, this information, to program it directly without having to run the virtual machine at all. So what I did, I put all of this as a skill and open-sourced it so that now, um, now everyone, if any of you by any chance have a Viking phone, you don't have to set up Windows machine.

You can just ask Claude Code, like, give this, uh, skill to Claude Code, and, uh, it will set it up.

Um, yeah. Victory. Uh, it works. I mean, I didn't go into much details about how this step works because it's super easy thanks to ElevenLabs. We, we really made it and Twilio. I mean, this step is super easy.

This one was the most painful part. I think it took me, like, a couple of days to, to reverse engineer it. I'm really trying to avoid the word hack, uh, that I hacked the phone. I reverse engineered it.

Um,

yeah. So, I mean, what we learned about the protocol, it has two layers. Um, the encryption, it we were lucky that the encryption was just a single-byte checksum because it, if it was something harder, then it would probably be much harder to break.

And, um, yeah. And the persistence bit, we had to run the server, intermediate server between virtual Windows machine and, and the phone. And that's how just, yeah, to comment on the step five here, um,

without Claude Code, it wouldn't be possible to, to, to do that demo. It, it, it's not just it made it 10 times faster. It just made it possible because I'm not a, a security, security engineer whatsoever. I'm actually, like, just a normal software engineer.

And I had, like when I looked at all this, like, programs, I was like, what, what is that? What is that? What is 0x? Okay. Um, yeah. That's it. Um, so now, uh, the outcome of this is not just a nice demo that you can see on the third floor.

It's also a skill that makes it much easier to, to program the, this, this kind of phone. And, um, the nice part is that I think this is extendable to other hardware as well. So it's not just, like, Viking specific, but, like, if you want to crack some other hardware, I would really recommend thinking about well, you don't the, the difference is that one year ago, you actually needed the proprietary software interface that the provide the, the company that made the hardware provides.

Now you don't need it. You can connect to, to the phone, but you can the same way you can connect to any, like, piece of hardware in your house. Um, so this is this is cool. Um, yeah. This is how it started.

Uh, yeah. And the, the actual demo, again, to people who just came here. On the third floor, we have, uh, this red telephone booth. Uh, lets you speak to Michael Caine. Uh, how many of you have tried it?

Have, has anyone? Oh my God. Okay. You should totally try it. It's, it's it feels magical, and I just, uh, told you how I how I made it into real life. Yeah. Um, any, I guess, any questions? This is the booth, and this is Sweeks.

Do you know how many tokens you burn?

I used ElevenLabs, uh, our corporate token. So I, I yeah. I think it was an order of between 10 and 100 dollars. So quite reasonable.

And, and did, did you have the did you have Claude? So, so you had some software that you installed on UTM on Windows. Did you have Claude control that as well? Or, or, or did somebody have to manually control?

It, it was it was a quite interesting process because my participation in that was basically following Claude's commands.

Right.

So it would tell me, like, hey, can you can you, like, take the handle, and how many beeps can you hear? And I would, like, listen, and I'm like, okay. I think three. I was like, you idiot. It's either two or four.

And I'm like, oh, yeah. It's two. So it was, like, I was actually, like, the agent for Claude. Like, Claude was orchestrating the whole thing. And answering your no. Answering your basically, I was the hands for Claude. It couldn't really I think if I used, like, computer use or something, I could, uh, make it fully, like, close the close the loop and make it control the virtual machine.

But I was too lazy, so I just did what it told me to do.

Were there any places where Claude got stuck and you had to help, or is it?

Uh, stuck in, in what sense?

As in, could you figure out the next step?

So that's the thing. It, it was orchestrating it. Like, I had no idea what was going on. So intellectually, I couldn't unblock it.

How did you just unblock it?

I unblocked it by, like, actually, like, rebooting, like, physically rebooting the phone, or, like, controlling the virtual machine. But the intellectual part, which is, like, cracking the cracking the algorithm, I could I wouldn't be able to unblock it.

I mean, it was just smarter than me, I think. Yeah. Um.

How, how did you physically connect to the phone?

Yeah. I, I wish I had a picture. Um,

so this phone, you can see the black cable.

Yeah.

It's, uh, called, uh, Power over Ethernet, PoE.

Yeah.

Which is, uh, basically, there is an Ethernet cable, the one that everyone probably has at home for home internet. And there is also a power adapter, and it brings them together. And I put a router in between, which let me connect my so this was connected to the router, and my laptop was connected to the Wi-Fi router as well.

And then yeah. And then there was this step of, uh, searching the network. So this was the first step. Claude just checked all of the devices connected to the router and found the, the phone.

Okay. Can I ask a quick time?

Yeah.

Next session coming in.

Thanks. Thanks, everyone.

Great.

Uh.