2000 Ford Explorer ABS Light On - how to pull codes?

MIL for ABS stays on whenever ignition is on. I replaced the rear speed sensor (3-channel system) a few months ago and the light went off for a while, then would go on only after the vehicle was moving, then changed to staying on all the time when the ignition is on.
I replaced the rear speed sensor (in the differential) again, no change. Inspected wiring for front sensors, no damage. I suspect the ABS control unit, but before I buy one and install it I would like to check codes. I don't have a ford factory scanner and my Toyota TechStream only reads engine control codes.
Is there a way to pull codes by watching the ABS light flash, or do I have to have the right scan tool?
Other history: New front and rear pads, resurfaced rotors on-vehicle.
Note, the RF wheel bearing was a little loose and I tightened it up (hub and ball bearing assembly type on this AWD vehicle). Could the RF sensor have been damaged by the loose wheel bearing?
When I was resurfacing the rotors the RF wheel bearing was quite loose. Tightening the axle nut eliminated all of the play. I realize that the bearing is probably failing but the car is for sale so I don't want to spend money on it if I can help it!
I mostly need a procedure to pull ABS codes - a generic OBD-II scanner will NOT work.