TP2 Readable addresses, AAA shared password for Sprint

[btwilli1]

My predicament: TP2 screen cracked, no insurance, taking opportunity to switch to Palm Pre, cloning esn etc.

I am trying to figure out my AAA 6 character shared secret password. I was able to get the HEX AAA password but sprint just uses the 6 character password. Short of calling and saying I need a NAI Password reset (how do you get into that discussion with a rep?), I figured I could scan the memory.

I am trying to locate the readable areas in memory using universal CDMA
So far 0xC000000 is readable
but once it gets to 0xC0D0000 it becomes unreadable and any scan I run resets the phone out of diagnostic mode. This is frustrating.

Does anyone know where the 6 character password is stored? I don't see it in QPST, any thoughts would be appreciated. Maybe a good starting address that is readable that I would find the user profile information in on the phone?