A Phone Three Engineers Couldn’t Crack

▶ Watch (01:45)

The Viking VOIP phone sat unused for a year at ElevenLabs’ San Francisco office. Three senior engineers and ChatGPT had tried and failed to configure it. The obstacle: the phone ships with Windows XP software only, and nobody at ElevenLabs runs Windows. A virtual machine hit driver errors. Without the configuration software running, there was no documented way to talk to the device at all.

Starkov’s approach was to skip the software entirely and communicate with the phone directly over the network via Claude Code.

Port Scan to Protocol Map

▶ Watch (04:21)

Claude Code started with nmap, scanning every open port on the phone until it found one that responded to probes. Sending a random string returned “ER” plus the string back, which meant error. That pattern revealed the phone used two-letter command codes. From there, the path was mechanical: brute-force of all two-letter command codes (06:13) across every AA-to-ZZ combination. Out of 676 pairs, 80 returned something other than an error, giving Claude a working command vocabulary from scratch.

When Settings Vanish on Reboot

▶ Watch (07:34)

Writing Twilio credentials to the phone worked, but a reboot wiped them. The settings landed in RAM only. Claude Code exhausted two-letter and three-letter command variants looking for a save command and found nothing. Its next move: run the Windows XP configuration software inside a VM, then intercept its traffic. The catch was that macOS blocks Wi-Fi bridging to VMs, so there was no direct network path. Claude’s fix was the TCP proxy intercept setup (09:25): a proxy on the Mac relayed VM traffic to the phone and logged every byte.

Cracking the Checksum and Packaging the Result

▶ Watch (10:35)

The intercepted traffic surfaced a command called TS with a binary payload and an unknown checksum. The checksum was one byte, so Claude brute-forced it, then confirmed the algorithm by running additional values through the same logic. It turned out to be a simple subtraction. With the full protocol decoded, Starkov factory-reset the phone and programmed it directly, with no VM required.

“it was just smarter than me, I think.” — Boris Starkov

The entire protocol knowledge ships as an open-source Claude Code skill. Anyone with a Viking phone can hand the skill to Claude Code and configure the device without touching Windows.

Q&A

How many tokens did you burn? Starkov estimated between $10 and $100 of tokens, using ElevenLabs corporate credits. ▶ 16:57

Did Claude control the Windows VM directly, or did you operate it manually? Starkov operated the VM by hand, following Claude’s instructions step by step, describing himself as ‘the hands for Claude’ while Claude orchestrated the logic. ▶ 17:13

Were there places where Claude got stuck and you had to unblock it? Starkov could only unblock physical steps like rebooting the phone; the algorithmic reasoning was entirely Claude’s, which he said was simply smarter than him. ▶ 18:13

Notable Quotes

Claude code found the way to communicate Boris Starkov · ▶ 4:45

“You idiot, it’s either two or four.” Boris Starkov · ▶ 17:44

it was just smarter than me, I think. Boris Starkov · ▶ 18:49

Key Takeaways

  • Claude Code brute-forced 676 two-letter command combinations and found 80 valid protocol commands with no documentation.
  • A TCP proxy intercepting Windows VM traffic was the unlock for understanding how to persist settings past reboot.
  • The result ships as an open-source Claude Code skill, so no one needs a Windows machine to program the phone again.