I haven't tried out empegVNC yet, but a question.. where are you grabbing the screen from? Do the Hijack menus show up on it?

If this is completely in userland, then Hijack probably does not appear. In that case, I can give you a /proc/empeg_screen raw image access to the display with Hijack menus/overlays in place, and your application could try that source first, and then default back to whereever it currently goes second..

Just a thought.