Hackin' a Solbourne

Well, I got my Solbourne (hi Mike!) this weekend. It's a S3000DX with 40MB RAM and runs OS/MP 4.1a. Two drives, nice box, excellent condition. The problem is that this box was production and I have no CDs to boot from, so I can't get into it in service mode so I can wipe it out. For lack of nothing better to do, I was able to "cp sd.si(,,)etc/password bw()" from the boot monitor and get the encrypted root password so that the 4-processor HP PA-RISC 2.0 L-class in the server room can have something to do other than run the school :-), but since there's > 6.6e+15 possibilities in that I was wondering if there's a faster way. It can understand UFS from the boot monitor, which is nice, and it does have a floppy drive, but I don't know what file system it expects to be on it (otherwise I'd copy etc/password off, blast the root crypt, and put a new one on -- or does this not work so good?). Any suggestions? How about hacking a Sun box with no password -- since this is a perverted SunOS machine in concept? :-) -- ----------------------------- personal page: http://www.armory.com/~spectre/ -- Cameron Kaiser, Point Loma Nazarene University * ckaiser(a)stockholm.ptloma.edu -- I couldn't care less about apathy. -----------------------------------------