I've just managed to open and close relay ports of the RFX9600 from my laptop by analyzing the frames.
What I've figured out so far:

RFX udp port: 65442
Hex:

open relay 1: 0000000000000000000000006300000600000000
close relay 1: 0000010000000000000000006300000600010000
open relay 2: 0000020000000000000000006300000601000000
close relay 2: 0000030000000000000000006300000601010000
toggle relay 1: 0000040000000000000000006400000500000000
toggle relay 2: 0000050000000000000000006400000501000000
query relay 1: 0000060000000000000000006500000500000000
query relay 2: 0000070000000000000000006500000501000000

response open relay 1: 00000640020000000000000500000000
response close relay 1: 00000740020000000000000501000000

There is a lot more communication going on, I think the remote asks the RFX if it's ready and the RFX tells the remote if it succeded and things like that. But just sending the commands works.

First part (000000) of the send command seems to be a number to indicate the sequence. 63 is open/close relay (64=toggle relay, 65=query relay, 40=IR, 50=RS232), the 00 (01, 02, 03) after that is the relay's port number, the 00 after that is open or close (01).
The response contains the sequence number (000006,000007) of the send item. Which makes sense because it uses UDP.
The bytes after the id (40) seem to be a reponse type or something like that(40=relaystate???), the bytes after that (02) are also a sequental number, some where around 01 is the relay's state (00 = open, 01 is closed)

I've start with the relays because their easier.

With RS232 I'm starting to figure out the command structure. It's not that hard either, it just has a lot more parameters like baudrate, parity, databits and stop bits. The command itselve is just ASCII character codes or hex.

IR is something I look at later, I need a learned command (not one from the database) because I can see what's send (you can only peek at learned codes).

It's a shame that I've got so much work to do. I've got a few projects I need to finish first.
Reading openremotes xml and dynamicly building the pronto gui from prontoscript is a job I'm looking to forward too aswell. But I can't do my daytime job, figure out the complete RFX protocol, get openremote to work with that protocol, build an openremote Pronto module (for the TSU) and do some other projects while keeping my child and wife happy. So come on guys, who's going to help?