But then, there are always easier ways to get to it. Because it has not been published does not mean that it has not or cannot be accomplished. In this case its the sync. Both the host and the token must have the same password during the same time frame. Since there is no communication between the two, there must be a way to sync.
Time is the key.
Some devices I have tested use DES to encrypt the time and thereby create a short lived password. If you use the same algorithm, with the same input, you will create the same password as that displayed on the token.