In addition, it seems awfully CPU-intensive compared to a one-time, four-byte change in the executable.

Maybe hijack could contain the modify-the-binary code itself, triggered by a menu somewhere.