The XStick/XBIB could only work with a custom firmware since inherently it never exposes the actual RF packets (like all the end-devcie beacons, requests to join and so on).
One would actually think such an image would be easy to make - just accept ALL of the bytes exiting the 'MAC' layer and dump them out via serial at 115kbps.
Now this MIGHT be limited in that you'd only see data for 1 PAN at a time. I don't think that would be a horrible limitation.