Reverse-engineering is cool thing, but it seems that better to have second unit if you are going to decrypt communication protocol.
I wonder what is the difference in front panel's MCU firmware (U1101 33120-88813 if I'm not mistaken) comparing to the one for other instruments like 34401A (for which firmware is accessible, and its MCU is mentioned as 34402). E3646A seems to have the same one, but not sure about 33120A - it has even more buttons as I see.