Disklavier

I'm working very hard nowadays to get DKVBrowser working on E3 and DKC-850 
pianos.

Is anyone out there with an E3/iPhone and the ability to packet sniff their 
network in promiscuous mode?  This would allow your PC to "hear" wireless 
communication between the iPhone and the piano.  I specifically need to see the 
encrypted handshake.  It should be in plain-text, and looks like this:

piano sends something like this:
  <rc_certificate param="dQJLQReq3eilwMAMkaAIPXLNheB9UsE8gnR4c6udiKyMw6xRg7" />

iPhone responds with something very similar: 
  <rc_certificate param="sEcx4E9XLbwjjWVxVglndLF0DvWytMRc" />

I was hoping that Yamaha didn't change this, but they did.  I think I'm close, 
but I'm missing a detail.  The length of the response string is important in 
this case...I don't know how long it is supposed to be...

Also, anyone out their happen to be experienced in reading ARM disassembly?  I'm 
quickly learning, but it would help to be able to bounce ideas off of someone 
else.

Another odd request.  And this one is a stretch.  Does anyone out there have an 
old/unused iPod Touch, iPhone that they would be willing to let me borrow?  I'm 
an android type guy, so I don't have one.  Having an iPhone type thing around to 
sniff the packets myself would be very helpful...

Thanks!
-Kevin