Hmmm this one looks really tricky. I just had a peek at some RMI overviews and there are several problems that present themselves:
1) Depending upon how your architecture is set up, the RMI
server may choose a random port. Somehow the client gets to this server and receives the stub.
2) Once a connection to this random port is established, the server initiates another connection for the RMI calls...
3) The objects are almost positively serialized, so getting at the internals would be non trivial.
If anyone out there has some deep knowledge of how RMI works I'd love to hear more - this is an interesting use case.
-Matt