Just that, somewhere inside the receiver after the RF section before the decoder chip is going to be the baseband signal, play around with a scope and a set of known pulses and you should be able to find it, then you just solder a wire to that particular pin and viola you can intercept a custom trasmission from a micro controller hooked up to a budy box. I checked the bandwidth of 10bit PCM systems and you should be able to get pretty close to 9600 baud data throughput, maybe more with a decent encoder/decoder.