Without using DOMs I can't do it. And since I don't like DOMs, I'll let Ace do it (it's really simple with DOMs, everything has IDs)
I looked through all the SMF php files and I found that a random variable is created when you load the page. This is the 'salt' for the encryption. It's the first four characters in an MD5 hash of a random integer. This is then concatenated to the end of (memberID & memberPass) then the resulting string is SHA1 encrypted. So yeah, having a bit of trouble reconstructing that hash to post back to the sever as I can't call the PHP function on the server directly so it won't match up. Sigh.