Reverse Engineering Legacy VoIP Hardware with Claude Code

Protocol Discovery and Brute Force

To reverse engineer the undocumented Viking VoIP phone, the author used Claude Code to scan the local network and identify the active communication port. After establishing a connection, the model sent random strings to the device to confirm the interface was active. The author then directed Claude Code to iterate through all possible two-letter command combinations. Out of the total permutations, 80 returned valid responses rather than error codes, revealing the command structure.

Traffic Interception and Checksum Derivation

While the phone accepted configuration commands, settings were lost upon reboot, indicating they were only stored in temporary memory. To find the persistence command, the author set up a Windows virtual machine running the manufacturer's proprietary configuration software. Because the Mac host could not bridge the virtual machine to the network, the author implemented a TCP proxy on the Mac to intercept and log traffic between the Windows software and the phone.

Claude Code analyzed the captured logs and identified a command with a binary payload containing a one-byte checksum. The model reverse-engineered the checksum formula by running known input-output pairs through a closed-loop iteration, eventually determining it was a simple subtraction-based calculation.

Implementation and Skill Creation

Once the protocol and checksum logic were understood, the author automated the configuration process. The final result was packaged as a Claude Code skill, allowing the phone to be configured directly without the legacy Windows software. The author acted as the physical interface for the model, performing tasks like rebooting the hardware and reporting audio feedback, while Claude Code orchestrated the logic and analysis.