diff -urNb nmap-4.00/docs/nmap.dtd nmap-4.00-dev/docs/nmap.dtd
--- nmap-4.00/docs/nmap.dtd	2005-11-22 23:22:00.000000000 +0000
+++ nmap-4.00-dev/docs/nmap.dtd	2006-02-04 07:23:23.543738757 +0000
@@ -44,7 +44,6 @@
 <!-- parameter entities to specify common "types" used elsewhere in the DTD -->
 <!ENTITY % attr_numeric "CDATA" >
 <!ENTITY % attr_ipaddr "CDATA" >
-<!ENTITY % attr_numeric "CDATA" >
 <!ENTITY % attr_type "(ipv4 | ipv6 | mac)" >
 
 <!ENTITY % host_states "(up|down|unknown|skipped)" >
@@ -66,7 +65,7 @@
 <!-- I don't know exactly what these are, but the values were enumerated via:
      grep "conf=" *
 --> 
-<!ENTITY % service_confs  "( 3 | 5 | 10)" >
+<!ENTITY % service_confs  "( 0 | 3 | 5 | 10)" >
 
 <!-- This element was started in nmap.c:nmap_main().
      It represents to the topmost element of the output document.
@@ -166,15 +165,15 @@
 			rpcnum		%attr_numeric;	#IMPLIED
 			lowver		%attr_numeric;	#IMPLIED
 			highver		%attr_numeric;	#IMPLIED
+                        hostname        CDATA           #IMPLIED
+                        ostype          CDATA           #IMPLIED
+                        devicetype      CDATA           #IMPLIED
+                        servicefp       CDATA           #IMPLIED
 >
 
-
 <!-- these elements are written by output.c: printosscanoutput() -->
 
-                        hostname        CDATA           #IMPLIED
-                        ostype          CDATA           #IMPLIED
-                        devicetype      CDATA           #IMPLIED
-<!ELEMENT os		( portused* , osclass*, osmatch* ) >
+<!ELEMENT os		( portused* , osclass*, osmatch*, osfingerprint?) >
 
 <!ELEMENT portused	EMPTY >
 <!ATTLIST portused
@@ -199,6 +198,11 @@
 			line    	%attr_numeric;	#REQUIRED
 >
 
+<!ELEMENT osfingerprint	EMPTY >
+<!ATTLIST osfingerprint
+			fingerprint	CDATA		#REQUIRED
+>
+
 <!ELEMENT uptime	EMPTY >
 <!ATTLIST uptime
 			seconds		%attr_numeric;	#REQUIRED
diff -urNb nmap-4.00/output.cc nmap-4.00-dev/output.cc
--- nmap-4.00/output.cc	2006-01-19 18:55:29.000000000 +0000
+++ nmap-4.00-dev/output.cc	2006-02-04 07:22:54.979984627 +0000
@@ -128,10 +128,11 @@
   char rpcbuf[128];
   char *xml_product = NULL, *xml_version = NULL, *xml_extrainfo = NULL;
   char *xml_hostname = NULL, *xml_ostype = NULL, *xml_devicetype = NULL;
+  char *xml_servicefp = NULL;
 
   if (xmlbuflen < 1) return -1;
   xmlbuf[0] = '\0';
-  if (!sd->name) return 0;
+  if (!sd->name && !sd->service_fp) return 0;
 
   if (sd->product) {
     xml_product = xml_convert(sd->product);
@@ -181,6 +182,14 @@
     versionxmlstring += '\"';
   }
 
+  if (sd->service_fp) {
+    xml_servicefp = xml_sf_convert(xml_convert(sd->service_fp));
+    versionxmlstring += " servicefp=\"";
+    versionxmlstring += xml_servicefp;
+    free(xml_devicetype); xml_servicefp = NULL;
+    versionxmlstring += '\"';
+  }
+
   if (o.rpcscan && sd->rpc_status == RPC_STATUS_GOOD_PROG) {
     snprintf(rpcbuf, sizeof(rpcbuf), 
 	     " rpcnum=\"%li\" lowver=\"%i\" highver=\"%i\" proto=\"rpc\"", 
@@ -189,7 +198,7 @@
 
   snprintf(xmlbuf, xmlbuflen, 
 	   "<service name=\"%s\"%s %smethod=\"%s\" conf=\"%d\"%s />", 
-	   sd->name,
+	   sd->name? sd->name : "unknown",
 	   versionxmlstring.c_str(),
 	   (sd->service_tunnel == SERVICE_TUNNEL_SSL)? "tunnel=\"ssl\" " : "",
 	   (sd->dtype == SERVICE_DETECTION_TABLE)? "table" : "probed", 
@@ -617,6 +626,29 @@
   return temp;
 }
 
+/* Remove all "\nSF:" from fingerprints */
+char* xml_sf_convert (const char* str) {
+  char *temp, *p;
+  char substr[5];
+  int strl = strlen(str);
+  temp = (char *) malloc(strl + 1);
+  char *end = (char *)str + strl + 1;
+  Strncpy(temp, str, strl + 1);
+  for (p = temp; end - str >= 4; p++) {
+    Strncpy(substr, str, 5);
+    substr[4] = 0;  /* Null term substr */
+    if (strcmp(substr, "\nSF:") == 0) {
+      str += 4;
+      Strncpy(p, str, strlen(str) + 1); /* Copy past "\nSF:" to end of str */
+      if (p > temp) p--;
+    } else {
+      str++;
+    }
+  }
+  temp = (char *) realloc(temp, strlen(temp) + 1);
+  return temp;
+}
+
 /* Write some information (printf style args) to the given log stream(s).
  Remember to watch out for format string bugs.  */
 void log_write(int logt, const char *fmt, ...)
diff -urNb nmap-4.00/output.h nmap-4.00-dev/output.h
--- nmap-4.00/output.h	2005-12-31 00:32:47.000000000 +0000
+++ nmap-4.00-dev/output.h	2006-02-04 07:22:54.979984627 +0000
@@ -207,4 +207,5 @@
 void printfinaloutput();
 
 char* xml_convert (const char* str);
+char* xml_sf_convert (const char* str);
 #endif /* OUTPUT_H */