I was doing it first by mmapping /dev/display (and I'm doing it horribly right now). I wouldn't be surprised if the Hijack menus didn't show up. I would like to move it to the kernel, as you suggested earlier, so I don't know if it's worth your while to set that up.

By the way, it looks like the empegVNC code will be easily less than your kftp/khttp code. It's really a very simple protocol, once you get how it's supposed to work. Looking at your kftpd/kttpd code, I'm not quite sure how to get data from display_blat() to my VNC server code, but I'll figure it out.