Add configurable client key algorithm

Introduces MessageBroker to enable communication between the dylib and QML via signals. Updates CMakeLists.txt to include Qml components and conditionally add MessageBroker sources in qmlrebuild mode. reMarkable.m is updated to register the QML type, set up native callbacks, and demonstrate broadcasting signals.

.gitignore

@@ -2,3 +2,5 @@ build/
 .DS_Store
 /.vscode
 /research
+/aqt_venv
+docs/rmfakecloud_hooking.md

CMakeLists.txt

@@ -8,10 +8,10 @@ set(CMAKE_CXX_STANDARD 17)
 
 # Build mode options
 # - rmfakecloud: Redirect reMarkable cloud to rmfakecloud server (default)
-# - qmldiff: Qt resource data registration hooking (WIP)
+# - qmlrebuild: Qt resource data registration hooking
 # - dev: Development/reverse engineering mode with all hooks
 option(BUILD_MODE_RMFAKECLOUD "Build with rmfakecloud support" ON)
-option(BUILD_MODE_QMLDIFF "Build with QML diff/resource hooking" OFF)
+option(BUILD_MODE_QMLREBUILD "Build with QML resource rebuilding" OFF)
 option(BUILD_MODE_DEV "Build with dev/reverse engineering hooks" OFF)
 
 # Compiler settings for macOS
@@ -28,6 +28,8 @@ set(PROJECT_ROOT_DIR ${CMAKE_CURRENT_SOURCE_DIR})
 include_directories(
     ${PROJECT_ROOT_DIR}/src/core
     ${PROJECT_ROOT_DIR}/src/utils
+    ${PROJECT_ROOT_DIR}/src/RMHook
+    ${PROJECT_ROOT_DIR}/libs/include
 )
 
 # Find required libraries
@@ -47,7 +49,7 @@ set(LIBS
 
 # Locate Qt libraries
 set(QT_LIB_TARGETS "")
-set(_qt_candidate_roots "$ENV{HOME}/Qt/6.10.0")
+set(_qt_candidate_roots "$ENV{HOME}/Qt/6.10.3/macos")
 
 foreach(_qt_root ${_qt_candidate_roots})
     if(_qt_root AND EXISTS "${_qt_root}")
@@ -55,13 +57,13 @@ foreach(_qt_root ${_qt_candidate_roots})
     endif()
 endforeach()
 
-find_package(Qt6 COMPONENTS Core Network WebSockets QUIET)
+find_package(Qt6 COMPONENTS Core Network WebSockets Qml QUIET)
 if(Qt6_FOUND)
-    set(QT_LIB_TARGETS Qt6::Core Qt6::Network Qt6::WebSockets)
+    set(QT_LIB_TARGETS Qt6::Core Qt6::Network Qt6::WebSockets Qt6::Qml)
 else()
-    find_package(Qt5 COMPONENTS Core Network WebSockets QUIET)
+    find_package(Qt5 COMPONENTS Core Network WebSockets Qml QUIET)
     if(Qt5_FOUND)
-        set(QT_LIB_TARGETS Qt5::Core Qt5::Network Qt5::WebSockets)
+        set(QT_LIB_TARGETS Qt5::Core Qt5::Network Qt5::WebSockets Qt5::Qml)
     endif()
 endif()
 
@@ -76,49 +78,60 @@ set(COMMON_SOURCES
     ${PROJECT_ROOT_DIR}/src/utils/ResourceUtils.m
 )
 
-# reMarkable dylib
-set(REMARKABLE_SOURCES
-    ${PROJECT_ROOT_DIR}/src/reMarkable/reMarkable.m
+# RMHook dylib
+set(RMHOOK_SOURCES
+    ${PROJECT_ROOT_DIR}/src/RMHook/RMHook.m
+    ${PROJECT_ROOT_DIR}/src/RMHook/Config.m
+    ${PROJECT_ROOT_DIR}/src/RMHook/SSLConfig.m
+    ${PROJECT_ROOT_DIR}/src/RMHook/DevHooks.m
 )
 
-add_library(reMarkable SHARED 
+add_library(RMHook SHARED 
     ${COMMON_SOURCES}
-    ${REMARKABLE_SOURCES}
+    ${RMHOOK_SOURCES}
 )
 
 # Set source files as Objective-C++
 set_source_files_properties(
-    ${REMARKABLE_SOURCES}
+    ${RMHOOK_SOURCES}
     PROPERTIES LANGUAGE OBJCXX
 )
 
-set_target_properties(reMarkable PROPERTIES
+set_target_properties(RMHook PROPERTIES
     PREFIX ""
     SUFFIX ".dylib"
-    OUTPUT_NAME "reMarkable"
+    OUTPUT_NAME "RMHook"
     LIBRARY_OUTPUT_DIRECTORY "${PROJECT_ROOT_DIR}/build/dylibs"
     MACOSX_RPATH ON
 )
 
 add_definitions(-DQT_NO_VERSION_TAGGING)
 
-# Add build mode compile definitions
+# Add build mode compile definitions and conditionally add sources
 if(BUILD_MODE_RMFAKECLOUD)
-    target_compile_definitions(reMarkable PRIVATE BUILD_MODE_RMFAKECLOUD=1)
+    target_compile_definitions(RMHook PRIVATE BUILD_MODE_RMFAKECLOUD=1)
     message(STATUS "Build mode: rmfakecloud (cloud redirection)")
 endif()
 
-if(BUILD_MODE_QMLDIFF)
-    target_compile_definitions(reMarkable PRIVATE BUILD_MODE_QMLDIFF=1)
-    message(STATUS "Build mode: qmldiff (resource hooking)")
+if(BUILD_MODE_QMLREBUILD)
+    target_compile_definitions(RMHook PRIVATE BUILD_MODE_QMLREBUILD=1)
+    
+    # Enable Qt MOC for MessageBroker
+    set_target_properties(RMHook PROPERTIES AUTOMOC ON)
+    
+    # Add MessageBroker source (needs MOC processing)
+    target_sources(RMHook PRIVATE 
+        ${PROJECT_ROOT_DIR}/src/utils/MessageBroker.mm
+    )
+    message(STATUS "Build mode: qmlrebuild (resource hooking)")
 endif()
 
 if(BUILD_MODE_DEV)
-    target_compile_definitions(reMarkable PRIVATE BUILD_MODE_DEV=1)
+    target_compile_definitions(RMHook PRIVATE BUILD_MODE_DEV=1)
     message(STATUS "Build mode: dev (reverse engineering)")
 endif()
 
-target_link_libraries(reMarkable PRIVATE 
+target_link_libraries(RMHook PRIVATE 
     ${LIBS}
     ${QT_LIB_TARGETS}
 )

LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2025 Rivoirard Noham
+Copyright (c) 2026 Rivoirard Noham
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

README.md

@@ -6,32 +6,47 @@ A dynamic library injection tool for the reMarkable Desktop macOS application, e
 
 RMHook hooks into the reMarkable Desktop app's network layer to redirect API calls from reMarkable's official cloud services to your own [rmfakecloud](https://github.com/ddvk/rmfakecloud) server. This allows you to maintain full control over your documents and data.
 
+## Other platforms
+
+- **[RMHook-Win](https://github.com/NohamR/RMHook-Win)**: Windows Desktop
+- **[RMHook-iOS](https://github.com/NohamR/RMHook-iOS)**: iOS
+- **[RMHook-Android](https://github.com/NohamR/RMHook-Android)**: Android
+
 ## Features
 
 - Network request interception and redirection
 - WebSocket connection patching
+- MQTT URI modification for screen sharing features
+- mTLS support for external access via Cloudflare Tunnel
 
 ## Compatibility
 
 **Tested and working on:**
-- reMarkable Desktop v3.24.0 (released 2025-12-03)
+- reMarkable Desktop v3.28.1 (released 2026-08-24)
 
 <p align="center">
-  <img src="docs/latest.png" width="40%" />
-  <img src="docs/rm.png" width="50%" />
+  <img src="docs/latest.png" width="45%" />
+  <img src="docs/rm.png" width="45%" />
 </p>
 
 ## Installation and usage
 
-### Important legal notice
-
 ⚠️ **For legal reasons, this repository does not include a pre-patched reMarkable app.** However, the latest compiled dylib is available in the [Releases](https://github.com/NohamR/RMHook/releases/latest) section.
 
-### Step 1: Prepare the reMarkable app
+### Auto installation
+
+Run in a terminal:
+```bash
+bash <(curl -sL https://raw.githubusercontent.com/NohamR/RMHook/refs/heads/main/scripts/auto-install.sh)
+```
+
+### Manual installation
+
+#### Step 1: Prepare the reMarkable app
 
 Uses the reMarkable Desktop app from your Applications folder or download it fresh from the [Mac App Store](https://apps.apple.com/app/remarkable-desktop/id1276493162).
 
-### Step 2: Inject the dylib
+#### Step 2: Inject the dylib
 
 Use the provided injection script:
 ```bash
@@ -45,9 +60,9 @@ This script will:
 - Remove the `_MASReceipt` folder
 - Fix file ownership
 
-### Step 3: Handle document storage
+#### Step 3: Handle document storage
 
-#### Important path changes
+##### Important path changes
 
 The original Mac App Store version stores data in sandboxed locations:
 **Original sandboxed paths:**
@@ -58,7 +73,7 @@ The original Mac App Store version stores data in sandboxed locations:
 - Config: `~/Library/Preferences/rmfakecloud.config`
 - Documents: `~/Library/Application Support/remarkable`
 
-#### Migration options
+##### Migration options
 
 **Option 1: Create a symbolic link** (recommended)
 ```bash
@@ -73,7 +88,7 @@ mv ~/Library/Containers/com.remarkable.desktop/Data/Library/Application\ Support
    ~/Library/Application\ Support/remarkable
 ```
 
-### Step 4: Configure rmfakecloud server
+#### Step 4: Configure rmfakecloud server
 Quickly access the configuration file from the app's Help menu:
 ![help-config.png](docs/help-config.png)
 
@@ -90,25 +105,112 @@ Example configuration:
 }
 ```
 
-### Step 5: Launch the patched app :p
-
-## How it works
-RMHook uses [tinyhook](https://github.com/Antibioticss/tinyhook/) to hook into Qt framework functions at runtime:
-1. **QNetworkAccessManager::createRequest** - Intercepts HTTP/HTTPS requests
-2. **QWebSocket::open** - Patches WebSocket connections
-
-When the app attempts to connect to reMarkable's servers (e.g., `internal.cloud.remarkable.com`), the hooks redirect these requests to your configured host and port.
+#### Step 5: Launch the patched app :p
 
 ## Configuration
 
 The config file (`~/Library/Preferences/rmfakecloud.config`) supports the following keys:
 | Key | Type | Default | Description |
-|--------|---------|-------------------|--------------------------------|
+|-----|------|---------|-------------|
 | `host` | String | `example.com` | Your rmfakecloud server host |
 | `port` | Number | `443` | Your rmfakecloud server port |
+| `client_cert` | String | (none) | Path to client certificate file (PEM) for mTLS |
+| `client_key` | String | (none) | Path to client private key file (PEM) for mTLS |
+| `key_algorithm` | String | `rsa` | Key algorithm: `rsa`, `ec`, `dsa`, `dh`, or `opaque` |
+| `ca_cert` | String | (none) | Path to custom CA certificate file (PEM) |
+| `disable_ssl_verification` | Boolean | `false` | Disable SSL peer verification (not recommended) |
 
 If the config file doesn't exist, it will be created automatically with default values on first launch.
 
+### External Access (Cloudflare Tunnel with Client Certificate)
+
+If your rmfakecloud instance is exposed via Cloudflare Tunnel with client certificate authentication, configure the additional TLS settings in `~/Library/Preferences/rmfakecloud.config`:
+
+```json
+{
+  "host": "rmfakecloud.example.com",
+  "port": 443,
+  "client_cert": "/path/to/client.crt",
+  "client_key": "/path/to/client.key"
+}
+```
+
+If your server uses a self-signed certificate or a certificate signed by a private CA:
+
+```json
+{
+  "host": "rmfakecloud.example.com",
+  "port": 443,
+  "client_cert": "/path/to/client.crt",
+  "client_key": "/path/to/client.key",
+  "ca_cert": "/path/to/ca.crt"
+}
+```
+
+See the [rmfakecloud external access guide](https://ddvk.github.io/rmfakecloud/install/external-access/) for generating the client certificate.
+
+## Building
+
+1. **Clone the repository:**
+```bash
+git clone http://github.com/NohamR/RMHook
+cd RMHook
+```
+
+Create a Python environment and install `aqtinstall`:
+```bash
+python3 -m venv aqt_venv
+source aqt_venv/bin/activate
+pip install aqtinstall
+aqt install-qt mac desktop 6.10.3 -m qtwebsockets --outputdir ~/Qt
+```
+
+2. **Compile the dylib:**
+```bash
+./scripts/build.sh [mode]
+```
+
+### Build modes
+
+The build script supports different modes for various use cases:
+
+| Mode | Description |
+|------|-------------|
+| `rmfakecloud` | Redirect reMarkable cloud to rmfakecloud server (default) |
+| `qmlrebuild` | Qt resource data registration hooking for QML replacement |
+| `dev` | Development/reverse engineering mode with all hooks |
+| `all` | Enable all modes |
+
+**Note (qmlrebuild mode):** When using the `qmlrebuild` feature, you must clear the Qt QML cache before launching the app:
+```bash
+rm -rf ~/Library/Caches/remarkable
+```
+Qt caches compiled QML files, so changes to QML resources won't take effect until the cache is cleared.
+
+Examples:
+```bash
+./scripts/build.sh              # Build with rmfakecloud mode (default)
+./scripts/build.sh rmfakecloud  # Explicitly build rmfakecloud mode
+./scripts/build.sh dev          # Build with dev/reverse engineering hooks
+./scripts/build.sh all          # Build with all modes enabled
+```
+
+## Debugging
+
+You can stream the macOS console logs to see output from the hooks:
+```bash
+log stream --predicate 'process == "reMarkable"' --level debug
+```
+
+## How it works
+
+RMHook uses [tinyhook](https://github.com/Antibioticss/tinyhook/) to hook into Qt framework functions at runtime:
+1. **QNetworkAccessManager::createRequest** - Intercepts HTTP/HTTPS requests
+2. **QWebSocket::open** - Patches WebSocket connections
+3. **MQTTAsync_createWithOptions** - Modifies MQTT URIs for screen sharing features
+
+When the app attempts to connect to reMarkable's servers (e.g., `internal.cloud.remarkable.com`), the hooks redirect these requests to your configured host and port.
+
 ## Troubleshooting
 
 ### App won't launch
@@ -122,6 +224,9 @@ If the config file doesn't exist, it will be created automatically with default
 
 ## Credits
 - xovi-rmfakecloud: [asivery/xovi-rmfakecloud](https://github.com/asivery/xovi-rmfakecloud) - Original hooking information
+- rm-xovi-extensions: [asivery/rm-xovi-extensions](https://github.com/asivery/rm-xovi-extensions) - Extension framework for reMarkable, used as reference for hooking Qt functions
+  - [qt-resource-rebuilder](https://github.com/asivery/rm-xovi-extensions/tree/master/qt-resource-rebuilder)
+  - [xovi-message-broker](https://github.com/asivery/rm-xovi-extensions/tree/master/xovi-message-broker)
 - tinyhook: [Antibioticss/tinyhook](https://github.com/Antibioticss/tinyhook/) - Function hooking framework
 - rmfakecloud: [ddvk/rmfakecloud](https://github.com/ddvk/rmfakecloud) - Self-hosted reMarkable cloud
 - optool: [alexzielenski/optool](https://github.com/alexzielenski/optool) - Mach-O binary modification tool
@@ -138,35 +243,3 @@ This project is not affiliated with, endorsed by, or sponsored by reMarkable AS.
 ## Contributing
 
 Contributions are welcome! Please feel free to submit issues or pull requests.
-
-## Building
-
-1. **Clone the repository:**
-```bash
-git clone http://github.com/NohamR/RMHook
-cd RMHook
-```
-
-2. **Compile the dylib:**
-```bash
-./scripts/build.sh [mode]
-```
-
-### Build modes
-
-The build script supports different modes for various use cases:
-
-| Mode | Description |
-|------|-------------|
-| `rmfakecloud` | Redirect reMarkable cloud to rmfakecloud server (default) |
-| `qmldiff` | Qt resource data registration hooking (WIP) |
-| `dev` | Development/reverse engineering mode with all hooks |
-| `all` | Enable all modes |
-
-Examples:
-```bash
-./scripts/build.sh              # Build with rmfakecloud mode (default)
-./scripts/build.sh rmfakecloud  # Explicitly build rmfakecloud mode
-./scripts/build.sh dev          # Build with dev/reverse engineering hooks
-./scripts/build.sh all          # Build with all modes enabled
-```

scripts/auto-install.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+REPO="NohamR/RMHook"
+FILE="rmfakecloud.dylib"
+APP_PATH="/Applications/remarkable.app"
+
+echo "[INFO] Downloading $FILE..."
+curl -sL \
+  -o "/tmp/$FILE" \
+  "https://github.com/$REPO/releases/latest/download/$FILE"
+
+# Fix the sandbox
+echo "[INFO] Linking sandbox directory..."
+ln -sf ~/Library/Containers/com.remarkable.desktop/Data/Library/Application\ Support/remarkable \
+      ~/Library/Application\ Support/remarkable
+
+echo "[INFO] Downloading inject script..."
+curl -sL \
+  -o "/tmp/inject.sh" \
+  "https://raw.githubusercontent.com/$REPO/refs/heads/main/scripts/inject.sh"
+
+echo "[INFO] Downloading optool..."
+curl -sL \
+  -o "/tmp/optool" \
+  "https://raw.githubusercontent.com/$REPO/refs/heads/main/scripts/optool"
+
+chmod +x /tmp/inject.sh /tmp/optool
+echo "[INFO] Running inject script..."
+/tmp/inject.sh "/tmp/$FILE" "$APP_PATH"

scripts/build.sh

@@ -3,7 +3,7 @@
 
 # Build modes:
 #   rmfakecloud - Redirect reMarkable cloud to rmfakecloud server (default)
-#   qmldiff     - Qt resource data registration hooking (WIP)
+#   qmlrebuild     - Qt resource data registration hooking
 #   dev         - Development/reverse engineering mode with all hooks
 
 PROJECT_DIR=$(cd "$(dirname "$0")/.." && pwd)
@@ -19,8 +19,8 @@ case "$BUILD_MODE" in
     rmfakecloud)
         DYLIB_NAME="rmfakecloud.dylib"
         ;;
-    qmldiff)
-        DYLIB_NAME="qmldiff.dylib"
+    qmlrebuild)
+        DYLIB_NAME="qmlrebuild.dylib"
         ;;
     dev)
         DYLIB_NAME="dev.dylib"
@@ -29,7 +29,7 @@ case "$BUILD_MODE" in
         DYLIB_NAME="all.dylib"
         ;;
     *)
-        DYLIB_NAME="reMarkable.dylib"
+        DYLIB_NAME="RMHook.dylib"
         ;;
 esac
 
@@ -37,25 +37,25 @@ esac
 CMAKE_OPTIONS=""
 case "$BUILD_MODE" in
     rmfakecloud)
-        CMAKE_OPTIONS="-DBUILD_MODE_RMFAKECLOUD=ON -DBUILD_MODE_QMLDIFF=OFF -DBUILD_MODE_DEV=OFF"
+        CMAKE_OPTIONS="-DBUILD_MODE_RMFAKECLOUD=ON -DBUILD_MODE_QMLREBUILD=OFF -DBUILD_MODE_DEV=OFF"
         ;;
-    qmldiff)
-        CMAKE_OPTIONS="-DBUILD_MODE_RMFAKECLOUD=OFF -DBUILD_MODE_QMLDIFF=ON -DBUILD_MODE_DEV=OFF"
+    qmlrebuild)
+        CMAKE_OPTIONS="-DBUILD_MODE_RMFAKECLOUD=OFF -DBUILD_MODE_QMLREBUILD=ON -DBUILD_MODE_DEV=OFF"
         ;;
     dev)
-        CMAKE_OPTIONS="-DBUILD_MODE_RMFAKECLOUD=OFF -DBUILD_MODE_QMLDIFF=OFF -DBUILD_MODE_DEV=ON"
+        CMAKE_OPTIONS="-DBUILD_MODE_RMFAKECLOUD=OFF -DBUILD_MODE_QMLREBUILD=OFF -DBUILD_MODE_DEV=ON"
         ;;
     all)
-        CMAKE_OPTIONS="-DBUILD_MODE_RMFAKECLOUD=ON -DBUILD_MODE_QMLDIFF=ON -DBUILD_MODE_DEV=ON"
+        CMAKE_OPTIONS="-DBUILD_MODE_RMFAKECLOUD=ON -DBUILD_MODE_QMLREBUILD=ON -DBUILD_MODE_DEV=ON"
         ;;
     *)
         echo "❌ Unknown build mode: $BUILD_MODE"
-        echo "Available modes: rmfakecloud (default), qmldiff, dev, all"
+        echo "Available modes: rmfakecloud (default), qmlrebuild, dev, all"
         exit 1
         ;;
 esac
 
-echo "🔨 Compiling reMarkable.dylib (mode: $BUILD_MODE)..."
+echo "🔨 Compiling RMHook.dylib (mode: $BUILD_MODE)..."
 echo "📦 Qt path: $QT_PATH"
 
 # Create build directories if necessary
@@ -70,12 +70,12 @@ else
     cmake $CMAKE_OPTIONS ..
 fi
 
-make reMarkable
+make RMHook
 
 if [ $? -eq 0 ]; then
     # Rename the produced dylib so each build mode has a distinct file name
     DYLIB_DIR="$PROJECT_DIR/build/dylibs"
-    DEFAULT_DYLIB="$DYLIB_DIR/reMarkable.dylib"
+    DEFAULT_DYLIB="$DYLIB_DIR/RMHook.dylib"
     TARGET_DYLIB="$DYLIB_DIR/$DYLIB_NAME"
 
     if [ -f "$DEFAULT_DYLIB" ]; then

src/RMHook/Config.h

@@ -0,0 +1,16 @@
+#import <Foundation/Foundation.h>
+#include <QtCore/QString>
+#include <QtNetwork/QSsl>
+
+extern NSString *gConfiguredHostObjC;
+extern NSNumber *gConfiguredPortObjC;
+extern QString gConfiguredHost;
+extern NSNumber *gConfiguredPort;
+extern QString gConfiguredClientCertPath;
+extern QString gConfiguredClientKeyPath;
+extern QString gConfiguredCACertPath;
+extern QSsl::KeyAlgorithm gConfiguredKeyAlgorithm;
+extern bool gDisableSSLVerification;
+
+void ConfigLoadOrCreate(void);
+NSString *ConfigFilePath(void);

src/RMHook/Config.m

@@ -0,0 +1,152 @@
+#import "Config.h"
+#import "Logger.h"
+#include <QtCore/QString>
+
+static NSString *const kConfigFileName = @"rmfakecloud.config";
+static NSString *const kConfigHostKey = @"host";
+static NSString *const kConfigPortKey = @"port";
+static NSString *const kConfigClientCertKey = @"client_cert";
+static NSString *const kConfigClientKeyKey = @"client_key";
+static NSString *const kConfigCACertKey = @"ca_cert";
+static NSString *const kConfigKeyAlgorithmKey = @"key_algorithm";
+static NSString *const kConfigDisableSSLVerifyKey = @"disable_ssl_verification";
+static NSString *const kDefaultHost = @"example.com";
+static NSNumber *const kDefaultPort = @(443);
+
+NSString *gConfiguredHostObjC = @"example.com";
+NSNumber *gConfiguredPortObjC = @(443);
+QString gConfiguredHost = QString::fromUtf8("example.com");
+NSNumber *gConfiguredPort = @(443);
+QString gConfiguredClientCertPath;
+QString gConfiguredClientKeyPath;
+QString gConfiguredCACertPath;
+QSsl::KeyAlgorithm gConfiguredKeyAlgorithm = QSsl::Rsa;
+bool gDisableSSLVerification = false;
+
+static NSString *PreferencesDirectory(void) {
+    NSArray<NSString *> *libraryPaths = NSSearchPathForDirectoriesInDomains(NSLibraryDirectory, NSUserDomainMask, YES);
+    NSString *libraryDir = [libraryPaths firstObject];
+    if (![libraryDir length]) {
+        libraryDir = [NSHomeDirectory() stringByAppendingPathComponent:@"Library"];
+    }
+    return [libraryDir stringByAppendingPathComponent:@"Preferences"];
+}
+
+NSString *ConfigFilePath(void) {
+    return [PreferencesDirectory() stringByAppendingPathComponent:kConfigFileName];
+}
+
+static BOOL WriteConfig(NSString *path, NSDictionary<NSString *, id> *config) {
+    NSError *error = nil;
+    NSData *jsonData = [NSJSONSerialization dataWithJSONObject:config options:NSJSONWritingPrettyPrinted error:&error];
+    if (!jsonData || error) {
+        NSLogger(@"[RMHook] Failed to serialize config: %@", error);
+        return NO;
+    }
+    if (![jsonData writeToFile:path atomically:YES]) {
+        NSLogger(@"[RMHook] Failed to write config file at %@", path);
+        return NO;
+    }
+    return YES;
+}
+
+static inline QString QStringFromNSStringSafe(NSString *string) {
+    if (!string) {
+        return QString();
+    }
+    return QString::fromUtf8([string UTF8String]);
+}
+
+void ConfigLoadOrCreate(void) {
+    NSString *configPath = ConfigFilePath();
+    NSString *directory = [configPath stringByDeletingLastPathComponent];
+    NSFileManager *fileManager = [NSFileManager defaultManager];
+    BOOL isDirectory = NO;
+    NSError *error = nil;
+
+    if (![fileManager fileExistsAtPath:directory isDirectory:&isDirectory] || !isDirectory) {
+        if (![fileManager createDirectoryAtPath:directory withIntermediateDirectories:YES attributes:nil error:&error]) {
+            NSLogger(@"[RMHook] Failed to create config directory %@: %@", directory, error);
+        }
+    }
+
+    NSDictionary<NSString *, id> *defaults = @{kConfigHostKey : kDefaultHost,
+                                               kConfigPortKey : kDefaultPort};
+
+    if ([fileManager fileExistsAtPath:configPath isDirectory:&isDirectory] && !isDirectory) {
+        NSData *data = [NSData dataWithContentsOfFile:configPath];
+        if ([data length] > 0) {
+            NSError *jsonError = nil;
+            id jsonObject = [NSJSONSerialization JSONObjectWithData:data options:0 error:&jsonError];
+            if (!jsonError && [jsonObject isKindOfClass:[NSDictionary class]]) {
+                NSDictionary *configDict = (NSDictionary *)jsonObject;
+                NSString *hostValue = configDict[kConfigHostKey];
+                NSNumber *portValue = configDict[kConfigPortKey];
+
+                NSString *resolvedHost = ([hostValue isKindOfClass:[NSString class]] && [hostValue length]) ? hostValue : kDefaultHost;
+                NSInteger portCandidate = kDefaultPort.integerValue;
+                if ([portValue respondsToSelector:@selector(integerValue)]) {
+                    NSInteger candidate = [portValue integerValue];
+                    if (candidate > 0 && candidate <= 65535) {
+                        portCandidate = candidate;
+                    } else {
+                        NSLogger(@"[RMHook] Ignoring invalid port value %@, falling back to default.", portValue);
+                    }
+                }
+
+                gConfiguredHostObjC = [resolvedHost copy];
+                gConfiguredPortObjC = @(portCandidate);
+                gConfiguredHost = QStringFromNSStringSafe(resolvedHost);
+                gConfiguredPort = @(portCandidate);
+
+                NSString *certPathValue = configDict[kConfigClientCertKey];
+                NSString *keyPathValue = configDict[kConfigClientKeyKey];
+                NSString *caPathValue = configDict[kConfigCACertKey];
+                NSNumber *disableSSLValue = configDict[kConfigDisableSSLVerifyKey];
+
+                if ([certPathValue isKindOfClass:[NSString class]] && [certPathValue length]) {
+                    gConfiguredClientCertPath = QStringFromNSStringSafe(certPathValue);
+                }
+                if ([keyPathValue isKindOfClass:[NSString class]] && [keyPathValue length]) {
+                    gConfiguredClientKeyPath = QStringFromNSStringSafe(keyPathValue);
+                }
+                if ([caPathValue isKindOfClass:[NSString class]] && [caPathValue length]) {
+                    gConfiguredCACertPath = QStringFromNSStringSafe(caPathValue);
+                }
+                NSString *keyAlgoValue = configDict[kConfigKeyAlgorithmKey];
+                if ([keyAlgoValue isKindOfClass:[NSString class]] && [keyAlgoValue length]) {
+                    NSString *lower = [keyAlgoValue lowercaseString];
+                    if ([lower isEqualToString:@"ec"]) {
+                        gConfiguredKeyAlgorithm = QSsl::Ec;
+                    } else if ([lower isEqualToString:@"dsa"]) {
+                        gConfiguredKeyAlgorithm = QSsl::Dsa;
+                    } else if ([lower isEqualToString:@"dh"]) {
+                        gConfiguredKeyAlgorithm = QSsl::Dh;
+                    } else if ([lower isEqualToString:@"opaque"]) {
+                        gConfiguredKeyAlgorithm = QSsl::Opaque;
+                    } else {
+                        gConfiguredKeyAlgorithm = QSsl::Rsa;
+                    }
+                }
+                if ([disableSSLValue respondsToSelector:@selector(boolValue)]) {
+                    gDisableSSLVerification = [disableSSLValue boolValue];
+                }
+
+                NSLogger(@"[RMHook] Loaded config from %@ with host %@ and port %@", configPath, gConfiguredHostObjC, gConfiguredPortObjC);
+                return;
+            } else {
+                NSLogger(@"[RMHook] Failed to parse config file %@: %@", configPath, jsonError);
+            }
+        } else {
+            NSLogger(@"[RMHook] Config file %@ was empty, rewriting with defaults.", configPath);
+        }
+    }
+
+    if (WriteConfig(configPath, defaults)) {
+        NSLogger(@"[RMHook] Created default config at %@", configPath);
+    }
+    gConfiguredHostObjC = [kDefaultHost copy];
+    gConfiguredPortObjC = kDefaultPort;
+    gConfiguredHost = QString::fromUtf8("example.com");
+    gConfiguredPort = kDefaultPort;
+}

src/RMHook/DevHooks.h

@@ -0,0 +1,47 @@
+#ifndef DEV_HOOKS_H
+#define DEV_HOOKS_H
+
+#ifdef BUILD_MODE_DEV
+
+#import <Foundation/Foundation.h>
+#include <stdint.h>
+
+// Forward declarations for Qt types
+class QIODevice;
+class QObject;
+namespace QtSharedPointer {
+    struct ExternalRefCountData;
+}
+
+extern ssize_t (*original_qIODevice_write)(QIODevice *self, const char *data, int64_t maxSize);
+extern int64_t (*original_qmlregister)(int64_t, int64_t, int64_t, int64_t, int64_t, int64_t, int, int64_t, int, int64_t);
+extern int64_t (*original_function_at_0x100011790)(uint64_t *a1);
+extern int64_t (*original_function_at_0x100011CE0)(int64_t, const QObject *, unsigned char, int64_t, QtSharedPointer::ExternalRefCountData *);
+extern int64_t (*original_function_at_0x10015A130)(int64_t, int64_t);
+extern void (*original_function_at_0x10015BC90)(int64_t, int64_t);
+extern int64_t (*original_function_at_0x10016D520)(int64_t, int64_t *, unsigned int, int64_t);
+extern void (*original_function_at_0x1001B6EE0)(int64_t, int64_t *, unsigned int);
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+ssize_t hooked_qIODevice_write(QIODevice *self, const char *data, int64_t maxSize);
+int64_t hooked_qmlregister(int64_t, int64_t, int64_t, int64_t, int64_t, int64_t, int, int64_t, int, int64_t);
+int64_t hooked_function_at_0x100011790(uint64_t *a1);
+int64_t hooked_function_at_0x100011CE0(int64_t, const QObject *, unsigned char, int64_t, QtSharedPointer::ExternalRefCountData *);
+int64_t hooked_function_at_0x10015A130(int64_t, int64_t);
+void hooked_function_at_0x10015BC90(int64_t, int64_t);
+int64_t hooked_function_at_0x10016D520(int64_t, int64_t *, unsigned int, int64_t);
+void hooked_function_at_0x1001B6EE0(int64_t, int64_t *, unsigned int);
+
+#ifdef __cplusplus
+}
+#endif
+
+void logMemory(const char *label, void *address, size_t length);
+void logStackTrace(const char *label);
+
+#endif // BUILD_MODE_DEV
+
+#endif // DEV_HOOKS_H

src/RMHook/DevHooks.m

@@ -0,0 +1,389 @@
+#ifdef BUILD_MODE_DEV
+
+#import "DevHooks.h"
+#import "Logger.h"
+#import <Foundation/Foundation.h>
+#include <stdint.h>
+#include <string.h>
+
+#include <QtCore/QIODevice>
+#include <QtCore/QObject>
+
+// Original function pointers
+ssize_t (*original_qIODevice_write)(QIODevice *self, const char *data, int64_t maxSize) = NULL;
+
+int64_t (*original_qmlregister)(
+    int64_t a1,
+    int64_t a2,
+    int64_t a3,
+    int64_t a4,
+    int64_t a5,
+    int64_t a6,
+    int a7,
+    int64_t a8,
+    int a9,
+    int64_t a10) = NULL;
+
+int64_t (*original_function_at_0x100011790)(uint64_t *a1) = NULL;
+int64_t (*original_function_at_0x100011CE0)(int64_t a1, const QObject *a2, unsigned char a3, int64_t a4, QtSharedPointer::ExternalRefCountData *a5) = NULL;
+int64_t (*original_function_at_0x10015A130)(int64_t a1, int64_t a2) = NULL;
+void (*original_function_at_0x10015BC90)(int64_t a1, int64_t a2) = NULL;
+int64_t (*original_function_at_0x10016D520)(int64_t a1, int64_t *a2, unsigned int a3, int64_t a4) = NULL;
+void (*original_function_at_0x1001B6EE0)(int64_t a1, int64_t *a2, unsigned int a3) = NULL;
+
+#pragma mark - Helper Functions
+
+void logMemory(const char *label, void *address, size_t length) {
+    if (!address) {
+        NSLogger(@"[RMHook]   %s: (null)", label);
+        return;
+    }
+    
+    unsigned char *ptr = (unsigned char *)address;
+    NSMutableString *hexLine = [NSMutableString stringWithFormat:@"[RMHook]   %s: ", label];
+    
+    for (size_t i = 0; i < length; i++) {
+        [hexLine appendFormat:@"%02x ", ptr[i]];
+        if ((i + 1) % 16 == 0 && i < length - 1) {
+            NSLogger(@"%@", hexLine);
+            hexLine = [NSMutableString stringWithString:@"[RMHook]                    "];
+        }
+    }
+    
+    // Log remaining bytes if any
+    if ([hexLine length] > 28) {  // More than just the prefix
+        NSLogger(@"%@", hexLine);
+    }
+}
+
+void logStackTrace(const char *label) {
+    NSLogger(@"[RMHook] %s - Stack trace:", label);
+    NSArray<NSString *> *callStack = [NSThread callStackSymbols];
+    NSUInteger count = [callStack count];
+    
+    for (NSUInteger i = 0; i < count; i++) {
+        NSString *frame = callStack[i];
+        NSLogger(@"[RMHook]   #%lu: %@", (unsigned long)i, frame);
+    }
+}
+
+#pragma mark - Hook Implementations
+
+extern "C" ssize_t hooked_qIODevice_write(
+    QIODevice *self,
+    const char *data,
+    int64_t maxSize) {
+    NSLogger(@"[RMHook] QIODevice::write called with maxSize: %lld", (long long)maxSize);
+    
+    logStackTrace("QIODevice::write call stack");
+    logMemory("Data to write", (void *)data, (size_t)(maxSize < 64 ? maxSize : 64));
+    
+    if (original_qIODevice_write) {
+        ssize_t result = original_qIODevice_write(self, data, maxSize);
+        NSLogger(@"[RMHook] QIODevice::write result: %zd", result);
+        return result;
+    }
+    NSLogger(@"[RMHook] WARNING: Original QIODevice::write not available, returning 0");
+    return 0;
+}
+
+extern "C" int64_t hooked_function_at_0x100011790(uint64_t *a1) {
+    NSLogger(@"[RMHook] Hook at 0x100011790 called!");
+    NSLogger(@"[RMHook]   a1 = %p", a1);
+
+    if (a1) {
+        NSLogger(@"[RMHook]   *a1 = 0x%llx", (unsigned long long)*a1);
+        logMemory("Memory at a1", (void *)a1, 64);
+        logMemory("Memory at *a1", (void *)(*a1), 64);
+    } else {
+        NSLogger(@"[RMHook]   a1 is NULL");
+    }
+
+    if (original_function_at_0x100011790) {
+        int64_t result = original_function_at_0x100011790(a1);
+        NSLogger(@"[RMHook]   result = 0x%llx", (unsigned long long)result);
+        return result;
+    }
+
+    NSLogger(@"[RMHook] WARNING: Original function at 0x100011790 not available, returning 0");
+    return 0;
+}
+
+extern "C" int64_t hooked_function_at_0x100011CE0(
+    int64_t a1,
+    const QObject *a2,
+    unsigned char a3,
+    int64_t a4,
+    QtSharedPointer::ExternalRefCountData *a5) {
+    // This function appears to be a QML type registration wrapper
+    // It calls QQmlPrivate::qmlregister(3, &registrationData)
+    // 
+    // Based on IDA analysis:
+    // - a1: stored at offset +0x8 in registration struct (likely type metadata ptr)
+    // - a2: NOT actually a QObject* - low bits used as: ((_WORD)a2 << 8) | a3
+    //       This suggests a2's low 16 bits are a version/revision number
+    // - a3: combined with a2 to form v17 (flags/version field)
+    // - a4: stored at offset +0x18 (likely URI or type info pointer)
+    // - a5: ExternalRefCountData* for shared pointer ref counting
+    
+    NSLogger(@"[RMHook] ========================================");
+    NSLogger(@"[RMHook] Hook at 0x100011CE0 (QML Type Registration)");
+    NSLogger(@"[RMHook] ========================================");
+    
+    NSLogger(@"[RMHook]   a1 (typeMetadata?)  = 0x%llx", (unsigned long long)a1);
+    
+    uint16_t a2_low = (uint16_t)(uintptr_t)a2;
+    uint16_t combined_v17 = (a2_low << 8) | a3;
+    NSLogger(@"[RMHook]   a2 (raw)            = %p (0x%llx)", a2, (unsigned long long)(uintptr_t)a2);
+    NSLogger(@"[RMHook]   a2 low 16 bits      = 0x%04x (%u)", a2_low, a2_low);
+    NSLogger(@"[RMHook]   a3 (flags/version)  = 0x%02x (%u)", a3, a3);
+    NSLogger(@"[RMHook]   v17 = (a2<<8)|a3    = 0x%04x (%u)", combined_v17, combined_v17);
+    NSLogger(@"[RMHook]   a4 (typeInfo/URI?)  = 0x%llx", (unsigned long long)a4);
+    NSLogger(@"[RMHook]   a5 (refCountData)   = %p", a5);
+    
+    if (a1) {
+        logMemory("Memory at a1 (typeMetadata)", (void *)a1, 64);
+        void **vtable = (void **)a1;
+        NSLogger(@"[RMHook]   a1 vtable/first ptr = %p", *vtable);
+    }
+    
+    if (a4) {
+        logMemory("Memory at a4 (typeInfo)", (void *)a4, 64);
+        const char *maybeStr = (const char *)a4;
+        bool isPrintable = true;
+        int len = 0;
+        for (int i = 0; i < 64 && maybeStr[i]; i++) {
+            if (maybeStr[i] < 0x20 || maybeStr[i] > 0x7e) {
+                isPrintable = false;
+                break;
+            }
+            len++;
+        }
+        if (isPrintable && len > 0) {
+            NSLogger(@"[RMHook]   a4 as string: \"%.*s\"", len, maybeStr);
+        }
+    }
+    
+    if (a5) {
+        logMemory("Memory at a5 (refCountData)", (void *)a5, 32);
+    }
+    
+    logStackTrace("QML Registration context");
+
+    if (original_function_at_0x100011CE0) {
+        int64_t result = original_function_at_0x100011CE0(a1, a2, a3, a4, a5);
+        NSLogger(@"[RMHook]   result (qmlregister return) = %u (0x%x)", (unsigned int)result, (unsigned int)result);
+        NSLogger(@"[RMHook] ========================================");
+        return result;
+    }
+
+    NSLogger(@"[RMHook] WARNING: Original function at 0x100011CE0 not available, returning 0");
+    return 0;
+}
+
+extern "C" int64_t hooked_function_at_0x10015A130(int64_t a1, int64_t a2) {
+    NSLogger(@"[RMHook] Hook at 0x10015A130 called!");
+    NSLogger(@"[RMHook]   a1 = 0x%llx", (unsigned long long)a1);
+    NSLogger(@"[RMHook]   a2 = 0x%llx", (unsigned long long)a2);
+
+    logMemory("Memory at a1", (void *)a1, 64);
+    logMemory("Memory at a2", (void *)a2, 64);
+
+    if (original_function_at_0x10015A130) {
+        int64_t result = original_function_at_0x10015A130(a1, a2);
+        NSLogger(@"[RMHook]   result = 0x%llx", (unsigned long long)result);
+        return result;
+    }
+
+    NSLogger(@"[RMHook] WARNING: Original function at 0x10015A130 not available, returning 0");
+    return 0;
+}
+
+extern "C" void hooked_function_at_0x10015BC90(int64_t a1, int64_t a2) {
+    NSLogger(@"[RMHook] Hook at 0x10015BC90 called!");
+    NSLogger(@"[RMHook]   a1 = 0x%llx", (unsigned long long)a1);
+    NSLogger(@"[RMHook]   a2 = 0x%llx", (unsigned long long)a2);
+
+    logMemory("Memory at a1", (void *)a1, 64);
+    logMemory("Memory at a2", (void *)a2, 64);
+
+    if (original_function_at_0x10015BC90) {
+        original_function_at_0x10015BC90(a1, a2);
+        NSLogger(@"[RMHook]   original function returned (void)");
+        return;
+    }
+
+    NSLogger(@"[RMHook] WARNING: Original function at 0x10015BC90 not available");
+}
+
+extern "C" int64_t hooked_function_at_0x10016D520(int64_t a1, int64_t *a2, unsigned int a3, int64_t a4) {
+    NSLogger(@"[RMHook] Hook at 0x10016D520 called!");
+    NSLogger(@"[RMHook]   a1 = 0x%llx", (unsigned long long)a1);
+    NSLogger(@"[RMHook]   a2 = %p", a2);
+    if (a2) {
+        NSLogger(@"[RMHook]   *a2 = 0x%llx", (unsigned long long)*a2);
+    }
+    NSLogger(@"[RMHook]   a3 = %u (0x%x)", a3, a3);
+    NSLogger(@"[RMHook]   a4 = 0x%llx", (unsigned long long)a4);
+    
+    logMemory("Memory at a1", (void *)a1, 64);
+    logMemory("Memory at a2", (void *)a2, 64);
+    
+    if (a2 && *a2 != 0) {
+        logMemory("Memory at *a2", (void *)*a2, 64);
+    }
+    
+    logMemory("Memory at a4", (void *)a4, 64);
+    
+    if (original_function_at_0x10016D520) {
+        int64_t result = original_function_at_0x10016D520(a1, a2, a3, a4);
+        NSLogger(@"[RMHook]   result = 0x%llx", (unsigned long long)result);
+        return result;
+    }
+    
+    NSLogger(@"[RMHook] WARNING: Original function not available, returning 0");
+    return 0;
+}
+
+extern "C" void hooked_function_at_0x1001B6EE0(int64_t a1, int64_t *a2, unsigned int a3) {
+    NSLogger(@"[RMHook] Hook at 0x1001B6EE0 called!");
+    NSLogger(@"[RMHook]   a1 = 0x%llx", (unsigned long long)a1);
+    
+    // At a1 (PdfExporter object):
+    // +0x10 contains a QString (likely document name)
+    NSLogger(@"[RMHook] Reading QString at a1+0x10:");
+    logMemory("a1 + 0x10 (raw)", (void *)(a1 + 0x10), 64);
+
+    void **qstrPtr = (void **)(a1 + 0x10);
+    void *dataPtr = *qstrPtr;
+
+    if (!dataPtr) {
+        NSLogger(@"[RMHook] QString has null data pointer");
+        return;
+    }
+
+    // Try reading potential size fields near dataPtr
+    int32_t size = 0;
+    for (int delta = 4; delta <= 32; delta += 4) {
+        int32_t candidate = *(int32_t *)((char *)dataPtr - delta);
+        if (candidate > 0 && candidate < 10000) {
+            size = candidate;
+            NSLogger(@"[RMHook] QString plausible size=%d (found at -%d)", size, delta);
+            break;
+        }
+    }
+
+    if (size > 0) {
+        NSString *qstringValue = [[NSString alloc] initWithCharacters:(unichar *)dataPtr length:size];
+        NSLogger(@"[RMHook] QString value: \"%@\"", qstringValue);
+    } else {
+        NSLogger(@"[RMHook] QString: could not find valid size");
+    }
+    
+    NSLogger(@"[RMHook]   a2 = %p", a2);
+    if (a2) {
+        NSLogger(@"[RMHook]   *a2 = 0x%llx", (unsigned long long)*a2);
+    }
+    NSLogger(@"[RMHook]   a3 = %u (0x%x)", a3, a3);
+    
+    if (original_function_at_0x1001B6EE0) {
+        original_function_at_0x1001B6EE0(a1, a2, a3);
+        NSLogger(@"[RMHook] Original function at 0x1001B6EE0 executed");
+    } else {
+        NSLogger(@"[RMHook] WARNING: Original function not available");
+    }
+}
+
+extern "C" int64_t hooked_qmlregister(
+    int64_t a1,
+    int64_t a2,
+    int64_t a3,
+    int64_t a4,
+    int64_t a5,
+    int64_t a6,
+    int a7,
+    int64_t a8,
+    int a9,
+    int64_t a10) {
+    
+    NSLogger(@"[RMHook] ========================================");
+    NSLogger(@"[RMHook] QQmlPrivate::qmlregister called!");
+    NSLogger(@"[RMHook] ========================================");
+    NSLogger(@"[RMHook]   a1 (RegistrationType) = 0x%llx (%lld)", (unsigned long long)a1, (long long)a1);
+    NSLogger(@"[RMHook]   a2  = 0x%llx (%lld)", (unsigned long long)a2, (long long)a2);
+    NSLogger(@"[RMHook]   a3  = 0x%llx (%lld)", (unsigned long long)a3, (long long)a3);
+    NSLogger(@"[RMHook]   a4  = 0x%llx (%lld)", (unsigned long long)a4, (long long)a4);
+    NSLogger(@"[RMHook]   a5  = 0x%llx (%lld)", (unsigned long long)a5, (long long)a5);
+    NSLogger(@"[RMHook]   a6  = 0x%llx (%lld)", (unsigned long long)a6, (long long)a6);
+    NSLogger(@"[RMHook]   a7  = 0x%x (%d)", a7, a7);
+    NSLogger(@"[RMHook]   a8  = 0x%llx (%lld)", (unsigned long long)a8, (long long)a8);
+    NSLogger(@"[RMHook]   a9  = 0x%x (%d)", a9, a9);
+    NSLogger(@"[RMHook]   a10 = 0x%llx (%lld)", (unsigned long long)a10, (long long)a10);
+    
+    // Check for PlatformHelpers registration
+    // a1 == 0 means TypeRegistration (object registration)
+    // a4 must be a valid pointer (not a small integer like 0, 1, 2, etc.)
+    if (a1 == 0 && a4 > 0x10000) {
+        const char *typeName = (const char *)a4;
+        
+        int len = 0;
+        bool isValid = true;
+        for (int i = 0; i < 256; i++) {
+            char c = typeName[i];
+            if (c == '\0') {
+                break;
+            }
+            if (c < 0x20 || c > 0x7e) {
+                isValid = false;
+                break;
+            }
+            len++;
+        }
+        
+        if (isValid && len > 0) {
+            NSLogger(@"[RMHook]   typeName (a4) = \"%.*s\"", len, typeName);
+            
+            if (len == 15 && strncmp(typeName, "PlatformHelpers", 15) == 0) {
+                NSLogger(@"[RMHook] !!! FOUND PlatformHelpers type registration !!!");
+                NSLogger(@"[RMHook]   factory ptr (a2) = %p", (void *)a2);
+                NSLogger(@"[RMHook]   a3 (metaObject?) = %p", (void *)a3);
+                NSLogger(@"[RMHook]   a5 = %p", (void *)a5);
+                NSLogger(@"[RMHook]   a6 = %p", (void *)a6);
+                logMemory("Factory ptr memory", (void *)a2, 64);
+                logMemory("a3 memory (metaObject?)", (void *)a3, 64);
+                logStackTrace("PlatformHelpers registration");
+            }
+        }
+    }
+    
+    // Try to interpret a2 as memory region for other registration types
+    if (a2 > 0x10000 && a1 != 0) {
+        logMemory("Memory at a2", (void *)a2, 64);
+        const char *maybeStr = (const char *)a2;
+        bool isPrintable = true;
+        int len = 0;
+        for (int i = 0; i < 128 && maybeStr[i]; i++) {
+            if (maybeStr[i] < 0x20 || maybeStr[i] > 0x7e) {
+                isPrintable = false;
+                break;
+            }
+            len++;
+        }
+        if (isPrintable && len > 0) {
+            NSLogger(@"[RMHook]   a2 as string: \"%.*s\"", len, maybeStr);
+        }
+    }
+    
+    int64_t result = 0;
+    if (original_qmlregister) {
+        result = original_qmlregister(a1, a2, a3, a4, a5, a6, a7, a8, a9, a10);
+        NSLogger(@"[RMHook]   result = 0x%llx (%lld)", (unsigned long long)result, (long long)result);
+    } else {
+        NSLogger(@"[RMHook] WARNING: Original qmlregister not available!");
+    }
+    
+    NSLogger(@"[RMHook] ========================================");
+    return result;
+}
+
+#endif // BUILD_MODE_DEV

src/RMHook/RMHook.h

@@ -1,5 +1,5 @@
 #import <Foundation/Foundation.h>
 
-@interface reMarkable : NSObject
+@interface RMHook : NSObject
 
 @end

src/RMHook/RMHook.m

@@ -0,0 +1,469 @@
+#import "RMHook.h"
+#import <Foundation/Foundation.h>
+#import "Constant.h"
+#import "MemoryUtils.h"
+#import "Logger.h"
+#import "ResourceUtils.h"
+#import "Config.h"
+#import "SSLConfig.h"
+#ifdef BUILD_MODE_DEV
+#import "DevHooks.h"
+#endif
+#ifdef BUILD_MODE_QMLREBUILD
+#import "MessageBroker.h"
+#endif
+#import <objc/runtime.h>
+#import <Cocoa/Cocoa.h>
+#include <stdint.h>
+#include <limits.h>
+#include <pthread.h>
+#include <stdlib.h>
+#include <string.h>
+#include <dispatch/dispatch.h>
+#include <string>
+
+#include <QtNetwork/QNetworkAccessManager>
+#include <QtNetwork/QNetworkRequest>
+#include <QtNetwork/QNetworkReply>
+#include <QtCore/QDebug>
+#include <QtCore/QIODevice>
+#include <QtCore/QUrl>
+#include <QtCore/QString>
+#include <QtCore/Qt>
+#include <QtWebSockets/QWebSocket>
+
+static pthread_mutex_t gResourceMutex = PTHREAD_MUTEX_INITIALIZER;
+
+@interface MenuActionController : NSObject
+@property (strong, nonatomic) NSURL *targetURL;
+- (void)openURLAction:(id)sender;
++ (void)addCustomHelpMenuEntry:(NSString *)title withURL:(NSString *)url;
++ (void)addCustomHelpMenuEntry:(NSString *)title withURL:(NSString *)url withDelay:(NSTimeInterval)delay;
+@end
+
+@implementation MenuActionController
+
+- (void)openURLAction:(id)sender {
+    if (self.targetURL) {
+        [[NSWorkspace sharedWorkspace] openURL:self.targetURL];
+        NSLogger(@"[+] URL opened successfully: %@", self.targetURL);
+    }
+}
+
++ (void)addCustomHelpMenuEntry:(NSString *)title withURL:(NSString *)url {
+    [self addCustomHelpMenuEntry:title withURL:url withDelay:1.0];
+}
+
++ (void)addCustomHelpMenuEntry:(NSString *)title withURL:(NSString *)url withDelay:(NSTimeInterval)delay {
+    dispatch_after(dispatch_time(DISPATCH_TIME_NOW, (int64_t)(delay * NSEC_PER_SEC)), dispatch_get_main_queue(), ^{
+        MenuActionController *controller = [[MenuActionController alloc] init];
+        controller.targetURL = [NSURL URLWithString:url];
+        
+        NSMenu *mainMenu = [NSApp mainMenu];
+        if (!mainMenu) {
+            NSLogger(@"[-] Main menu not found");
+            return;
+        }
+        
+        NSMenuItem *helpMenuItem = nil;
+        for (NSMenuItem *item in [mainMenu itemArray]) {
+            if ([[item title] isEqualToString:@"Help"]) {
+                helpMenuItem = item;
+                break;
+            }
+        }
+        
+        if (!helpMenuItem) {
+            NSLogger(@"[-] Help menu item not found");
+            return;
+        }
+        
+        NSMenu *helpMenu = [helpMenuItem submenu];
+        if (!helpMenu) {
+            NSLogger(@"[-] Help submenu not found");
+            return;
+        }
+        
+        if ([helpMenu numberOfItems] > 0) {
+            [helpMenu addItem:[NSMenuItem separatorItem]];
+        }
+        
+        NSMenuItem *customMenuItem = [[NSMenuItem alloc] initWithTitle:title 
+                                                              action:@selector(openURLAction:) 
+                                                       keyEquivalent:@""];
+        [customMenuItem setTarget:controller];
+        [helpMenu addItem:customMenuItem];
+        
+        objc_setAssociatedObject(helpMenu, 
+                                [title UTF8String], 
+                                controller, 
+                                OBJC_ASSOCIATION_RETAIN);
+        
+        NSLogger(@"[+] Custom menu item '%@' added successfully", title);
+    });
+}
+
+@end
+
+@interface RMHookDylib : NSObject
+
+- (BOOL)hook;
+
+@end
+
+@implementation RMHook
+
++ (void)load {
+    NSLogger(@"RMHook dylib loaded successfully");
+    
+    RMHookDylib *dylib = [[RMHookDylib alloc] init];
+    [dylib hook];
+    
+#ifdef BUILD_MODE_RMFAKECLOUD
+    NSString *configPath = ConfigFilePath();
+    NSString *fileURL = [NSString stringWithFormat:@"file://%@", configPath];
+    [MenuActionController addCustomHelpMenuEntry:@"Open rmfakecloud config" 
+                                         withURL:fileURL 
+                                       withDelay:2.0];
+#endif
+}
+
+@end
+
+@implementation RMHookDylib
+
+#ifdef BUILD_MODE_RMFAKECLOUD
+static QNetworkReply *(*original_qNetworkAccessManager_createRequest)(
+    QNetworkAccessManager *self,
+    QNetworkAccessManager::Operation op,
+    const QNetworkRequest &request,
+    QIODevice *outgoingData) = NULL;
+
+static void (*original_qWebSocket_open)(
+    QWebSocket *self,
+    const QNetworkRequest &request) = NULL;
+
+typedef void* MQTTAsync;
+typedef void* MQTTAsync_createOptions;
+
+static int (*original_MQTTAsync_createWithOptions)(
+    MQTTAsync *handle,
+    const char *serverURI,
+    const char *clientId,
+    int persistence_type,
+    void *persistence_context,
+    MQTTAsync_createOptions *options) = NULL;
+#endif
+
+#ifdef BUILD_MODE_QMLREBUILD
+static int (*original_qRegisterResourceData)(
+    int,
+    const unsigned char *,
+    const unsigned char *,
+    const unsigned char *) = NULL;
+#endif
+
+#ifdef BUILD_MODE_RMFAKECLOUD
+static inline bool shouldPatchURL(const QString &host) {
+    if (host.isEmpty()) {
+        return false;
+    }
+
+    return QString(R"""(
+        hwr-production-dot-remarkable-production.appspot.com
+        service-manager-production-dot-remarkable-production.appspot.com
+        local.appspot.com
+        my.remarkable.com
+        ping.remarkable.com
+        internal.cloud.remarkable.com
+        eu.tectonic.remarkable.com
+        backtrace-proxy.cloud.remarkable.engineering
+        dev.ping.remarkable.com
+        dev.tectonic.remarkable.com
+        dev.internal.cloud.remarkable.com
+        eu.internal.tctn.cloud.remarkable.com
+        webapp-prod.cloud.remarkable.engineering
+    )""")
+        .contains(host, Qt::CaseInsensitive);
+}
+#endif
+
+static inline QString QStringFromNSStringSafe(NSString *string) {
+    if (!string) {
+        return QString();
+    }
+    return QString::fromUtf8([string UTF8String]);
+}
+
+- (BOOL)hook {
+    NSLogger(@"[RMHook] Starting hooks...");
+
+#ifdef BUILD_MODE_RMFAKECLOUD
+    NSLogger(@"[RMHook] Build mode: rmfakecloud");
+    ConfigLoadOrCreate();
+    SSLConfigLoad();
+    NSLogger(@"[RMHook] Using override host %@ and port %@", gConfiguredHostObjC, gConfiguredPortObjC);
+
+    [MemoryUtils hookSymbol:@"QtNetwork"
+                        symbolName:@"__ZN21QNetworkAccessManager13createRequestENS_9OperationERK15QNetworkRequestP9QIODevice"
+                      hookFunction:(void *)hooked_qNetworkAccessManager_createRequest
+                  originalFunction:(void **)&original_qNetworkAccessManager_createRequest
+                         logPrefix:@"[RMHook]"];
+
+    [MemoryUtils hookSymbol:@"QtWebSockets"
+                        symbolName:@"__ZN10QWebSocket4openERK15QNetworkRequest"
+                      hookFunction:(void *)hooked_qWebSocket_open
+                  originalFunction:(void **)&original_qWebSocket_open
+                         logPrefix:@"[RMHook]"];
+
+    [MemoryUtils hookSymbol:@"libpaho-mqtt3as.1.dylib"
+                        symbolName:@"_MQTTAsync_createWithOptions"
+                      hookFunction:(void *)hooked_MQTTAsync_createWithOptions
+                  originalFunction:(void **)&original_MQTTAsync_createWithOptions
+                         logPrefix:@"[RMHook]"];
+#endif
+
+#ifdef BUILD_MODE_QMLREBUILD
+    NSLogger(@"[RMHook] Build mode: qmlrebuild");
+    
+    messagebroker::registerQmlType();
+    
+    messagebroker::setNativeCallback([](const char *signal, const char *value) {
+        NSLogger(@"[RMHook] Native callback received signal '%s' with value '%s'", signal, value);
+    });
+    
+    [MemoryUtils hookSymbol:@"QtCore"
+                        symbolName:@"__Z21qRegisterResourceDataiPKhS0_S0_"
+                      hookFunction:(void *)hooked_qRegisterResourceData
+                  originalFunction:(void **)&original_qRegisterResourceData
+                         logPrefix:@"[RMHook]"];
+
+    dispatch_after(dispatch_time(DISPATCH_TIME_NOW, (int64_t)(3.0 * NSEC_PER_SEC)), dispatch_get_main_queue(), ^{
+        messagebroker::broadcast("signalName", "Hello from dylib!");
+    });
+#endif
+
+#ifdef BUILD_MODE_DEV
+    NSLogger(@"[RMHook] Build mode: dev/reverse engineering");
+#endif
+
+    return YES;
+}
+
+#ifdef BUILD_MODE_RMFAKECLOUD
+extern "C" QNetworkReply* hooked_qNetworkAccessManager_createRequest(
+    QNetworkAccessManager* self,
+    QNetworkAccessManager::Operation op,
+    const QNetworkRequest& req,
+    QIODevice* outgoingData
+) {
+    const QString host = req.url().host();
+    if (shouldPatchURL(host)) {
+        QNetworkRequest newReq(req);
+        QUrl newUrl = req.url();
+        const QString overrideHost = QStringFromNSStringSafe(gConfiguredHostObjC);
+        newUrl.setHost(overrideHost);
+        newUrl.setPort([gConfiguredPortObjC intValue]);
+        newReq.setUrl(newUrl);
+
+        SSLConfigApplyToRequest(newReq);
+
+        if (original_qNetworkAccessManager_createRequest) {
+            return original_qNetworkAccessManager_createRequest(self, op, newReq, outgoingData);
+        }
+        return nullptr;
+    }
+
+    if (original_qNetworkAccessManager_createRequest) {
+        return original_qNetworkAccessManager_createRequest(self, op, req, outgoingData);
+    }
+    return nullptr;
+}
+
+extern "C" void hooked_qWebSocket_open(
+    QWebSocket* self,
+    const QNetworkRequest& req
+) {
+    if (!original_qWebSocket_open) {
+        return;
+    }
+
+    const QString host = req.url().host();
+    if (shouldPatchURL(host)) {
+        QUrl newUrl = req.url();
+        const QString overrideHost = QStringFromNSStringSafe(gConfiguredHostObjC);
+        newUrl.setHost(overrideHost);
+        newUrl.setPort([gConfiguredPortObjC intValue]);
+
+        QNetworkRequest newReq(req);
+        newReq.setUrl(newUrl);
+
+        SSLConfigApplyToRequest(newReq);
+
+        original_qWebSocket_open(self, newReq);
+        return;
+    }
+
+    original_qWebSocket_open(self, req);
+}
+
+static std::string PatchMqttUri(const char* uri)
+{
+    if (!uri) return {};
+    const std::string original(uri);
+
+    size_t schemeEnd = original.find("://");
+    size_t hostStart = (schemeEnd != std::string::npos) ? schemeEnd + 3 : 0;
+    size_t hostEnd   = original.find_first_of(":/", hostStart);
+    if (hostEnd == std::string::npos) hostEnd = original.size();
+
+    const std::string origHost = original.substr(hostStart, hostEnd - hostStart);
+
+    static const char* kSuffixes[] = {
+        ".remarkable.com",
+        ".remarkable.engineering",
+        nullptr
+    };
+    bool shouldPatch = false;
+    for (int i = 0; kSuffixes[i]; ++i)
+    {
+        const std::string suffix(kSuffixes[i]);
+        if (origHost.size() >= suffix.size() &&
+            origHost.compare(origHost.size() - suffix.size(),
+                             suffix.size(), suffix) == 0)
+        {
+            shouldPatch = true;
+            break;
+        }
+    }
+    if (!shouldPatch) return {};
+
+    std::string patched = original;
+    std::string proxyHost = [gConfiguredHostObjC UTF8String];
+    patched.replace(hostStart, hostEnd - hostStart, proxyHost);
+
+    size_t colonPos = patched.find(':', hostStart + proxyHost.size());
+    if (colonPos != std::string::npos)
+    {
+        size_t numEnd = patched.find_first_not_of("0123456789", colonPos + 1);
+        if (numEnd == std::string::npos) numEnd = patched.size();
+        patched.replace(colonPos + 1, numEnd - colonPos - 1,
+                        std::to_string([gConfiguredPortObjC intValue]));
+    }
+    return patched;
+}
+
+extern "C" int hooked_MQTTAsync_createWithOptions(
+    MQTTAsync *handle,
+    const char *serverURI,
+    const char *clientId,
+    int persistence_type,
+    void *persistence_context,
+    MQTTAsync_createOptions *options)
+{
+    if (!original_MQTTAsync_createWithOptions) {
+        return -1;
+    }
+
+    std::string patchedUri = PatchMqttUri(serverURI);
+    if (!patchedUri.empty()) {
+        NSLogger(@"[RMHook] Patching MQTT URI from %s to %s", serverURI, patchedUri.c_str());
+        return original_MQTTAsync_createWithOptions(handle, patchedUri.c_str(), clientId, persistence_type, persistence_context, options);
+    }
+
+    return original_MQTTAsync_createWithOptions(handle, serverURI, clientId, persistence_type, persistence_context, options);
+}
+#endif // BUILD_MODE_RMFAKECLOUD
+
+#ifdef BUILD_MODE_QMLREBUILD
+
+extern "C" int hooked_qRegisterResourceData(
+    int version,
+    const unsigned char *tree,
+    const unsigned char *name,
+    const unsigned char *data
+) {
+    if (!original_qRegisterResourceData) {
+        return 0;
+    }
+
+    pthread_mutex_lock(&gResourceMutex);
+    struct ResourceRoot resource = {
+        .data = (uint8_t *)data,
+        .name = (uint8_t *)name,
+        .tree = (uint8_t *)tree,
+
+        .treeSize = 0,
+        .dataSize = 0,
+        .originalDataSize = 0,
+        .nameSize = 0,
+
+        .entriesAffected = 0,
+    };
+
+    NSLogger(@"[RMHook] Registering Qt resource version %d tree:%p name:%p data:%p",
+             version, tree, name, data);
+
+    statArchive(&resource, 0);
+    
+    resource.tree = (uint8_t *)malloc(resource.treeSize);
+    if (!resource.tree) {
+        NSLogger(@"[RMHook] Failed to allocate tree buffer");
+        pthread_mutex_unlock(&gResourceMutex);
+        return original_qRegisterResourceData(version, tree, name, data);
+    }
+    memcpy(resource.tree, tree, resource.treeSize);
+
+    processNode(&resource, 0, "");
+    NSLogger(@"[RMHook] Processing done! Entries affected: %d, dataSize: %zu, originalDataSize: %zu", 
+             resource.entriesAffected, resource.dataSize, resource.originalDataSize);
+
+    const unsigned char *finalTree = tree;
+    const unsigned char *finalData = data;
+    uint8_t *newDataBuffer = NULL;
+
+    if (resource.entriesAffected > 0) {
+        NSLogger(@"[RMHook] Rebuilding data tables... (entries: %d)", resource.entriesAffected);
+        
+        newDataBuffer = (uint8_t *)malloc(resource.dataSize);
+        if (!newDataBuffer) {
+            NSLogger(@"[RMHook] Failed to allocate new data buffer (%zu bytes)", resource.dataSize);
+            free(resource.tree);
+            clearReplacementEntries();
+            pthread_mutex_unlock(&gResourceMutex);
+            return original_qRegisterResourceData(version, tree, name, data);
+        }
+        
+        memcpy(newDataBuffer, data, resource.originalDataSize);
+        
+        struct ReplacementEntry *entry = getReplacementEntries();
+        while (entry) {
+            writeUint32(newDataBuffer, (int)entry->copyToOffset, (uint32_t)entry->size);
+            memcpy(newDataBuffer + entry->copyToOffset + 4, entry->data, entry->size);
+            
+            NSLogger(@"[RMHook] Copied replacement for node %d at offset %zu (%zu bytes)", 
+                     entry->node, entry->copyToOffset, entry->size);
+            
+            entry = entry->next;
+        }
+        
+        finalTree = resource.tree;
+        finalData = newDataBuffer;
+        
+        NSLogger(@"[RMHook] Data buffer rebuilt: original %zu bytes -> new %zu bytes", 
+                 resource.originalDataSize, resource.dataSize);
+    }
+
+    int status = original_qRegisterResourceData(version, finalTree, name, finalData);
+    
+    clearReplacementEntries();
+    if (resource.tree && resource.entriesAffected == 0) {
+        free(resource.tree);
+    }
+    
+    pthread_mutex_unlock(&gResourceMutex);
+    return status;
+}
+#endif // BUILD_MODE_QMLREBUILD
+
+@end

src/RMHook/SSLConfig.h

@@ -0,0 +1,4 @@
+#include <QtNetwork/QNetworkRequest>
+
+void SSLConfigLoad(void);
+void SSLConfigApplyToRequest(QNetworkRequest &request);

src/RMHook/SSLConfig.m

@@ -0,0 +1,92 @@
+#import "SSLConfig.h"
+#import "Config.h"
+#import "Logger.h"
+#include <QtNetwork/QSslConfiguration>
+#include <QtNetwork/QSslCertificate>
+#include <QtNetwork/QSslKey>
+#include <QtNetwork/QSslSocket>
+#include <QtCore/QFile>
+#include <QtCore/QIODevice>
+
+static QSslCertificate gClientCert;
+static QSslKey gClientKey;
+static QSslCertificate gCACert;
+static bool gSSLInitialized = false;
+
+void SSLConfigLoad(void) {
+    if (gSSLInitialized) return;
+
+    if (!gConfiguredClientCertPath.isEmpty() && !gConfiguredClientKeyPath.isEmpty()) {
+        QString certPath = gConfiguredClientCertPath;
+        QString keyPath = gConfiguredClientKeyPath;
+
+        QFile certFile(QString::fromUtf8(certPath.toUtf8()));
+        if (certFile.open(QIODevice::ReadOnly)) {
+            gClientCert = QSslCertificate(certFile.readAll(), QSsl::Pem);
+            certFile.close();
+            if (gClientCert.isNull()) {
+                NSLogger(@"[RMHook] Failed to parse client certificate from %s", certPath.toUtf8().constData());
+            } else {
+                NSLogger(@"[RMHook] Loaded client certificate from %s", certPath.toUtf8().constData());
+            }
+        } else {
+            NSLogger(@"[RMHook] Failed to open client certificate file %s", certPath.toUtf8().constData());
+        }
+
+        QFile keyFile(QString::fromUtf8(keyPath.toUtf8()));
+        if (keyFile.open(QIODevice::ReadOnly)) {
+            gClientKey = QSslKey(keyFile.readAll(), gConfiguredKeyAlgorithm, QSsl::Pem, QSsl::PrivateKey);
+            keyFile.close();
+            if (gClientKey.isNull()) {
+                NSLogger(@"[RMHook] Failed to parse client key from %s", keyPath.toUtf8().constData());
+            } else {
+                NSLogger(@"[RMHook] Loaded client key from %s", keyPath.toUtf8().constData());
+            }
+        } else {
+            NSLogger(@"[RMHook] Failed to open client key file %s", keyPath.toUtf8().constData());
+        }
+    }
+
+    if (!gConfiguredCACertPath.isEmpty()) {
+        QString caPath = gConfiguredCACertPath;
+        QFile caFile(QString::fromUtf8(caPath.toUtf8()));
+        if (caFile.open(QIODevice::ReadOnly)) {
+            gCACert = QSslCertificate(caFile.readAll(), QSsl::Pem);
+            caFile.close();
+            if (gCACert.isNull()) {
+                NSLogger(@"[RMHook] Failed to parse CA certificate from %s", caPath.toUtf8().constData());
+            } else {
+                NSLogger(@"[RMHook] Loaded CA certificate from %s", caPath.toUtf8().constData());
+            }
+        } else {
+            NSLogger(@"[RMHook] Failed to open CA certificate file %s", caPath.toUtf8().constData());
+        }
+    }
+
+    gSSLInitialized = true;
+}
+
+void SSLConfigApplyToRequest(QNetworkRequest &request) {
+    if (!gSSLInitialized) return;
+
+    QSslConfiguration sslConfig = QSslConfiguration::defaultConfiguration();
+
+    if (!gClientCert.isNull() && !gClientKey.isNull()) {
+        QList<QSslCertificate> localCerts = sslConfig.localCertificateChain();
+        localCerts.append(gClientCert);
+        sslConfig.setLocalCertificateChain(localCerts);
+        sslConfig.setPrivateKey(gClientKey);
+    }
+
+    if (!gCACert.isNull()) {
+        QList<QSslCertificate> caCerts = sslConfig.caCertificates();
+        caCerts.append(gCACert);
+        sslConfig.setCaCertificates(caCerts);
+    }
+
+    if (gDisableSSLVerification) {
+        sslConfig.setPeerVerifyMode(QSslSocket::VerifyNone);
+    }
+
+    request.setSslConfiguration(sslConfig);
+}

src/reMarkable/reMarkable.m

@@ -1,649 +0,0 @@
-#import "reMarkable.h"
-#import <Foundation/Foundation.h>
-#import "Constant.h"
-#import "MemoryUtils.h"
-#import "Logger.h"
-#import "ResourceUtils.h"
-#import <objc/runtime.h>
-#import <Cocoa/Cocoa.h>
-#include <stdint.h>
-#include <limits.h>
-#include <pthread.h>
-#include <stdlib.h>
-#include <string.h>
-#include <dispatch/dispatch.h>
-
-#include <QtNetwork/QNetworkAccessManager>
-#include <QtNetwork/QNetworkRequest>
-#include <QtNetwork/QNetworkReply>
-#include <QtCore/QDebug>
-#include <QtCore/QIODevice>
-#include <QtCore/QUrl>
-#include <QtCore/QString>
-#include <QtCore/Qt>
-#include <QtWebSockets/QWebSocket>
-#include <QtCore/QSettings>
-#include <QtCore/QVariant>
-#include <QtCore/QAnyStringView>
-
-static NSString *const kReMarkableConfigFileName = @"rmfakecloud.config";
-static NSString *const kReMarkableConfigHostKey = @"host";
-static NSString *const kReMarkableConfigPortKey = @"port";
-static NSString *const kReMarkableDefaultHost = @"example.com";
-static NSNumber *const kReMarkableDefaultPort = @(443);
-
-static NSString *gConfiguredHost = @"example.com";
-static NSNumber *gConfiguredPort = @(443);
-static pthread_mutex_t gResourceMutex = PTHREAD_MUTEX_INITIALIZER;
-
-static NSString *ReMarkablePreferencesDirectory(void);
-
-static NSString *ReMarkablePreferencesDirectory(void) {
-    NSArray<NSString *> *libraryPaths = NSSearchPathForDirectoriesInDomains(NSLibraryDirectory, NSUserDomainMask, YES);
-    NSString *libraryDir = [libraryPaths firstObject];
-    if (![libraryDir length]) {
-        libraryDir = [NSHomeDirectory() stringByAppendingPathComponent:@"Library"];
-    }
-    return [libraryDir stringByAppendingPathComponent:@"Preferences"];
-}
-
-static NSString *ReMarkableConfigFilePath(void) {
-    return [ReMarkablePreferencesDirectory() stringByAppendingPathComponent:kReMarkableConfigFileName];
-}
-
-static BOOL ReMarkableWriteConfig(NSString *path, NSDictionary<NSString *, id> *config) {
-    NSError *error = nil;
-    NSData *jsonData = [NSJSONSerialization dataWithJSONObject:config options:NSJSONWritingPrettyPrinted error:&error];
-    if (!jsonData || error) {
-        NSLogger(@"[reMarkable] Failed to serialize config: %@", error);
-        return NO;
-    }
-    if (![jsonData writeToFile:path atomically:YES]) {
-        NSLogger(@"[reMarkable] Failed to write config file at %@", path);
-        return NO;
-    }
-    return YES;
-}
-
-static void ReMarkableLoadOrCreateConfig(void) {
-    NSString *configPath = ReMarkableConfigFilePath();
-    NSString *directory = [configPath stringByDeletingLastPathComponent];
-    NSFileManager *fileManager = [NSFileManager defaultManager];
-    BOOL isDirectory = NO;
-    NSError *error = nil;
-
-    if (![fileManager fileExistsAtPath:directory isDirectory:&isDirectory] || !isDirectory) {
-        if (![fileManager createDirectoryAtPath:directory withIntermediateDirectories:YES attributes:nil error:&error]) {
-            NSLogger(@"[reMarkable] Failed to create config directory %@: %@", directory, error);
-        }
-    }
-
-    NSDictionary<NSString *, id> *defaults = @{kReMarkableConfigHostKey : kReMarkableDefaultHost,
-                                               kReMarkableConfigPortKey : kReMarkableDefaultPort};
-
-    if ([fileManager fileExistsAtPath:configPath isDirectory:&isDirectory] && !isDirectory) {
-        NSData *data = [NSData dataWithContentsOfFile:configPath];
-        if ([data length] > 0) {
-            NSError *jsonError = nil;
-            id jsonObject = [NSJSONSerialization JSONObjectWithData:data options:0 error:&jsonError];
-            if (!jsonError && [jsonObject isKindOfClass:[NSDictionary class]]) {
-                NSDictionary *configDict = (NSDictionary *)jsonObject;
-                NSString *hostValue = configDict[kReMarkableConfigHostKey];
-                NSNumber *portValue = configDict[kReMarkableConfigPortKey];
-
-                NSString *resolvedHost = ([hostValue isKindOfClass:[NSString class]] && [hostValue length]) ? hostValue : kReMarkableDefaultHost;
-                NSInteger portCandidate = kReMarkableDefaultPort.integerValue;
-                if ([portValue respondsToSelector:@selector(integerValue)]) {
-                    NSInteger candidate = [portValue integerValue];
-                    if (candidate > 0 && candidate <= 65535) {
-                        portCandidate = candidate;
-                    } else {
-                        NSLogger(@"[reMarkable] Ignoring invalid port value %@, falling back to default.", portValue);
-                    }
-                }
-
-                gConfiguredHost = [resolvedHost copy];
-                gConfiguredPort = @(portCandidate);
-                NSLogger(@"[reMarkable] Loaded config from %@ with host %@ and port %@", configPath, gConfiguredHost, gConfiguredPort);
-                return;
-            } else {
-                NSLogger(@"[reMarkable] Failed to parse config file %@: %@", configPath, jsonError);
-            }
-        } else {
-            NSLogger(@"[reMarkable] Config file %@ was empty, rewriting with defaults.", configPath);
-        }
-    }
-
-    if (ReMarkableWriteConfig(configPath, defaults)) {
-        NSLogger(@"[reMarkable] Created default config at %@", configPath);
-    }
-    gConfiguredHost = [kReMarkableDefaultHost copy];
-    gConfiguredPort = kReMarkableDefaultPort;
-}
-
-static inline QString QStringFromNSStringSafe(NSString *string) {
-    if (!string) {
-        return QString();
-    }
-    return QString::fromUtf8([string UTF8String]);
-}
-
-@interface MenuActionController : NSObject
-@property (strong, nonatomic) NSURL *targetURL;
-- (void)openURLAction:(id)sender;
-+ (void)addCustomHelpMenuEntry:(NSString *)title withURL:(NSString *)url;
-+ (void)addCustomHelpMenuEntry:(NSString *)title withURL:(NSString *)url withDelay:(NSTimeInterval)delay;
-@end
-
-@implementation MenuActionController
-
-- (void)openURLAction:(id)sender {
-    if (self.targetURL) {
-        [[NSWorkspace sharedWorkspace] openURL:self.targetURL];
-        NSLogger(@"[+] URL opened successfully: %@", self.targetURL);
-    }
-}
-
-+ (void)addCustomHelpMenuEntry:(NSString *)title withURL:(NSString *)url {
-    [self addCustomHelpMenuEntry:title withURL:url withDelay:1.0];
-}
-
-+ (void)addCustomHelpMenuEntry:(NSString *)title withURL:(NSString *)url withDelay:(NSTimeInterval)delay {
-    dispatch_after(dispatch_time(DISPATCH_TIME_NOW, (int64_t)(delay * NSEC_PER_SEC)), dispatch_get_main_queue(), ^{
-        MenuActionController *controller = [[MenuActionController alloc] init];
-        controller.targetURL = [NSURL URLWithString:url];
-        
-        NSMenu *mainMenu = [NSApp mainMenu];
-        if (!mainMenu) {
-            NSLogger(@"[-] Main menu not found");
-            return;
-        }
-        
-        NSMenuItem *helpMenuItem = nil;
-        for (NSMenuItem *item in [mainMenu itemArray]) {
-            if ([[item title] isEqualToString:@"Help"]) {
-                helpMenuItem = item;
-                break;
-            }
-        }
-        
-        if (!helpMenuItem) {
-            NSLogger(@"[-] Help menu item not found");
-            return;
-        }
-        
-        NSMenu *helpMenu = [helpMenuItem submenu];
-        if (!helpMenu) {
-            NSLogger(@"[-] Help submenu not found");
-            return;
-        }
-        
-        if ([helpMenu numberOfItems] > 0) {
-            [helpMenu addItem:[NSMenuItem separatorItem]];
-        }
-        
-        NSMenuItem *customMenuItem = [[NSMenuItem alloc] initWithTitle:title 
-                                                              action:@selector(openURLAction:) 
-                                                       keyEquivalent:@""];
-        [customMenuItem setTarget:controller];
-        [helpMenu addItem:customMenuItem];
-        
-        objc_setAssociatedObject(helpMenu, 
-                                [title UTF8String], 
-                                controller, 
-                                OBJC_ASSOCIATION_RETAIN);
-        
-        NSLogger(@"[+] Custom menu item '%@' added successfully", title);
-    });
-}
-
-@end
-
-@interface reMarkableDylib : NSObject
-
-- (BOOL)hook;
-
-@end
-
-@implementation reMarkable
-
-+ (void)load {
-    NSLogger(@"reMarkable dylib loaded successfully");
-    
-    // Initialize the hook
-    reMarkableDylib *dylib = [[reMarkableDylib alloc] init];
-    [dylib hook];
-    
-#ifdef BUILD_MODE_RMFAKECLOUD
-    // Add custom Help menu entry to open config file
-    NSString *configPath = ReMarkableConfigFilePath();
-    NSString *fileURL = [NSString stringWithFormat:@"file://%@", configPath];
-    [MenuActionController addCustomHelpMenuEntry:@"Open rmfakecloud config" 
-                                         withURL:fileURL 
-                                       withDelay:2.0];
-#endif
-}
-
-@end
-
-@implementation reMarkableDylib
-
-#ifdef BUILD_MODE_RMFAKECLOUD
-static QNetworkReply *(*original_qNetworkAccessManager_createRequest)(
-    QNetworkAccessManager *self,
-    QNetworkAccessManager::Operation op,
-    const QNetworkRequest &request,
-    QIODevice *outgoingData) = NULL;
-
-static void (*original_qWebSocket_open)(
-    QWebSocket *self,
-    const QNetworkRequest &request) = NULL;
-#endif
-
-#ifdef BUILD_MODE_QMLDIFF
-static int (*original_qRegisterResourceData)(
-    int,
-    const unsigned char *,
-    const unsigned char *,
-    const unsigned char *) = NULL;
-#endif
-
-#ifdef BUILD_MODE_DEV
-static ssize_t (*original_qIODevice_write)(
-    QIODevice *self,
-    const char *data,
-    qint64 maxSize) = NULL;
-
-// Hook for function at 0x10015A130
-static int64_t (*original_function_at_0x10015A130)(int64_t a1, int64_t a2) = NULL;
-
-// Hook for function at 0x10015BC90
-static void (*original_function_at_0x10015BC90)(int64_t a1, int64_t a2) = NULL;
-
-// Hook for function at 0x10016D520
-static int64_t (*original_function_at_0x10016D520)(int64_t a1, int64_t *a2, unsigned int a3, int64_t a4) = NULL;
-
-// Hook for function at 0x1001B6EE0
-static void (*original_function_at_0x1001B6EE0)(int64_t a1, int64_t *a2, unsigned int a3) = NULL;
-#endif
-
-#if defined(BUILD_MODE_DEV)
-// Memory logging helper function
-static void logMemory(const char *label, void *address, size_t length) {
-    if (!address) {
-        NSLogger(@"[reMarkable]   %s: (null)", label);
-        return;
-    }
-    
-    unsigned char *ptr = (unsigned char *)address;
-    NSMutableString *hexLine = [NSMutableString stringWithFormat:@"[reMarkable]   %s: ", label];
-    
-    for (size_t i = 0; i < length; i++) {
-        [hexLine appendFormat:@"%02x ", ptr[i]];
-        if ((i + 1) % 16 == 0 && i < length - 1) {
-            NSLogger(@"%@", hexLine);
-            hexLine = [NSMutableString stringWithString:@"[reMarkable]                    "];
-        }
-    }
-    
-    // Log remaining bytes if any
-    if ([hexLine length] > 28) {  // More than just the prefix
-        NSLogger(@"%@", hexLine);
-    }
-}
-
-// Stack trace logging helper function
-static void logStackTrace(const char *label) {
-    NSLogger(@"[reMarkable] %s - Stack trace:", label);
-    NSArray<NSString *> *callStack = [NSThread callStackSymbols];
-    NSUInteger count = [callStack count];
-    
-    // Skip first 2 frames (this function and the immediate caller's logging statement)
-    for (NSUInteger i = 0; i < count; i++) {
-        NSString *frame = callStack[i];
-        NSLogger(@"[reMarkable]   #%lu: %@", (unsigned long)i, frame);
-    }
-}
-#endif
-
-#ifdef BUILD_MODE_RMFAKECLOUD
-static inline bool shouldPatchURL(const QString &host) {
-    if (host.isEmpty()) {
-        return false;
-    }
-
-    return QString(R"""(
-        hwr-production-dot-remarkable-production.appspot.com
-        service-manager-production-dot-remarkable-production.appspot.com
-        local.appspot.com
-        my.remarkable.com
-        ping.remarkable.com
-        internal.cloud.remarkable.com
-        eu.tectonic.remarkable.com
-        backtrace-proxy.cloud.remarkable.engineering
-        dev.ping.remarkable.com
-        dev.tectonic.remarkable.com
-        dev.internal.cloud.remarkable.com
-        eu.internal.tctn.cloud.remarkable.com
-        webapp-prod.cloud.remarkable.engineering
-    )""")
-        .contains(host, Qt::CaseInsensitive);
-}
-#endif
-
-- (BOOL)hook {
-    NSLogger(@"[reMarkable] Starting hooks...");
-
-#ifdef BUILD_MODE_RMFAKECLOUD
-    NSLogger(@"[reMarkable] Build mode: rmfakecloud");
-    ReMarkableLoadOrCreateConfig();
-    NSLogger(@"[reMarkable] Using override host %@ and port %@", gConfiguredHost, gConfiguredPort);
-
-    [MemoryUtils hookSymbol:@"QtNetwork"
-                        symbolName:@"__ZN21QNetworkAccessManager13createRequestENS_9OperationERK15QNetworkRequestP9QIODevice"
-                      hookFunction:(void *)hooked_qNetworkAccessManager_createRequest
-                  originalFunction:(void **)&original_qNetworkAccessManager_createRequest
-                         logPrefix:@"[reMarkable]"];
-
-    [MemoryUtils hookSymbol:@"QtWebSockets"
-                        symbolName:@"__ZN10QWebSocket4openERK15QNetworkRequest"
-                      hookFunction:(void *)hooked_qWebSocket_open
-                  originalFunction:(void **)&original_qWebSocket_open
-                         logPrefix:@"[reMarkable]"];
-#endif
-
-#ifdef BUILD_MODE_QMLDIFF
-    NSLogger(@"[reMarkable] Build mode: qmldiff");
-    [MemoryUtils hookSymbol:@"QtCore"
-                        symbolName:@"__Z21qRegisterResourceDataiPKhS0_S0_"
-                      hookFunction:(void *)hooked_qRegisterResourceData
-                  originalFunction:(void **)&original_qRegisterResourceData
-                         logPrefix:@"[reMarkable]"];
-#endif
-
-#ifdef BUILD_MODE_DEV
-    // // Hook function at address 0x1????
-    // [MemoryUtils hookAddress:@"reMarkable"
-    //            staticAddress:0x????
-    //             hookFunction:(void *)hooked_function_at_0x????
-    //         originalFunction:(void **)&original_function_at_0x????
-    //                logPrefix:@"[reMarkable]"];
-    
-    NSLogger(@"[reMarkable] Build mode: dev/reverse engineering");
-    // [MemoryUtils hookSymbol:@"QtCore"
-    //                 symbolName:@"__ZN9QIODevice5writeEPKcx"
-    //               hookFunction:(void *)hooked_qIODevice_write
-    //           originalFunction:(void **)&original_qIODevice_write
-    //                  logPrefix:@"[reMarkable]"];
-
-    // // Hook function at address 0x10015A130
-    // [MemoryUtils hookAddress:@"reMarkable"
-    //            staticAddress:0x10015A130
-    //             hookFunction:(void *)hooked_function_at_0x10015A130
-    //         originalFunction:(void **)&original_function_at_0x10015A130
-    //                logPrefix:@"[reMarkable]"];
-
-    // // Hook function at address 0x10015BC90
-    // [MemoryUtils hookAddress:@"reMarkable"
-    //            staticAddress:0x10015BC90
-    //             hookFunction:(void *)hooked_function_at_0x10015BC90
-    //         originalFunction:(void **)&original_function_at_0x10015BC90
-    //                logPrefix:@"[reMarkable]"];
-
-    // // Hook function at address 0x10016D520
-    // [MemoryUtils hookAddress:@"reMarkable"
-    //            staticAddress:0x10016D520
-    //             hookFunction:(void *)hooked_function_at_0x10016D520
-    //         originalFunction:(void **)&original_function_at_0x10016D520
-    //                logPrefix:@"[reMarkable]"];
-
-    // // Hook function at address 0x1001B6EE0
-    // [MemoryUtils hookAddress:@"reMarkable"
-    //            staticAddress:0x1001B6EE0
-    //             hookFunction:(void *)hooked_function_at_0x1001B6EE0
-    //         originalFunction:(void **)&original_function_at_0x1001B6EE0
-    //                logPrefix:@"[reMarkable]"];
-#endif
-
-    return YES;
-}
-
-#ifdef BUILD_MODE_RMFAKECLOUD
-extern "C" QNetworkReply* hooked_qNetworkAccessManager_createRequest(
-    QNetworkAccessManager* self,
-    QNetworkAccessManager::Operation op,
-    const QNetworkRequest& req,
-    QIODevice* outgoingData
-) {
-    const QString host = req.url().host();
-    if (shouldPatchURL(host)) {
-        // Clone request to keep original immutable
-        QNetworkRequest newReq(req);
-        QUrl newUrl = req.url();
-        const QString overrideHost = QStringFromNSStringSafe(gConfiguredHost);
-        newUrl.setHost(overrideHost);
-        newUrl.setPort([gConfiguredPort intValue]);
-        newReq.setUrl(newUrl);
-
-        if (original_qNetworkAccessManager_createRequest) {
-            return original_qNetworkAccessManager_createRequest(self, op, newReq, outgoingData);
-        }
-        return nullptr;
-    }
-
-    if (original_qNetworkAccessManager_createRequest) {
-        return original_qNetworkAccessManager_createRequest(self, op, req, outgoingData);
-    }
-    return nullptr;
-}
-
-extern "C" void hooked_qWebSocket_open(
-    QWebSocket* self,
-    const QNetworkRequest& req
-) {
-    if (!original_qWebSocket_open) {
-        return;
-    }
-
-    const QString host = req.url().host();
-    if (shouldPatchURL(host)) {
-        QUrl newUrl = req.url();
-        const QString overrideHost = QStringFromNSStringSafe(gConfiguredHost);
-        newUrl.setHost(overrideHost);
-        newUrl.setPort([gConfiguredPort intValue]);
-
-        QNetworkRequest newReq(req);
-        newReq.setUrl(newUrl);
-
-        original_qWebSocket_open(self, newReq);
-        return;
-    }
-
-    original_qWebSocket_open(self, req);
-}
-#endif // BUILD_MODE_RMFAKECLOUD
-
-#ifdef BUILD_MODE_QMLDIFF
-
-// See https://deepwiki.com/search/once-the-qrr-file-parsed-take_871f24a0-8636-4aee-bddf-7405b6e32584 for details on qmldiff replacement strategy
-
-extern "C" int hooked_qRegisterResourceData(
-    int version,
-    const unsigned char *tree,
-    const unsigned char *name,
-    const unsigned char *data
-) {
-    if (!original_qRegisterResourceData) {
-        return 0;
-    }
-
-    pthread_mutex_lock(&gResourceMutex);
-
-    struct ResourceRoot resource = {
-        .data = (uint8_t *)data,
-        .name = (uint8_t *)name,
-        .tree = (uint8_t *)tree,
-        .treeSize = 0,
-        .dataSize = 0,
-        .originalDataSize = 0,
-        .nameSize = 0,
-        .entriesAffected = 0,
-    };
-
-    statArchive(&resource, 0);
-    processNode(&resource, 0, "");
-    resource.tree = (uint8_t *)malloc(resource.treeSize);
-    if (resource.tree) {
-        memcpy(resource.tree, tree, resource.treeSize);
-    }
-
-    NSLogger(@"[reMarkable] Registering Qt resource version %d tree:%p (size:%zu) name:%p (size:%zu) data:%p (size:%zu)",
-             version, tree, resource.treeSize, name, resource.nameSize, data, resource.dataSize);
-
-    int status = original_qRegisterResourceData(version, tree, name, data);
-    pthread_mutex_unlock(&gResourceMutex);
-    if (resource.tree) {
-        free(resource.tree);
-    }
-    return status;
-}
-#endif // BUILD_MODE_QMLDIFF
-
-#ifdef BUILD_MODE_DEV
-extern "C" ssize_t hooked_qIODevice_write(
-    QIODevice *self,
-    const char *data,
-    qint64 maxSize) {
-    NSLogger(@"[reMarkable] QIODevice::write called with maxSize: %lld", (long long)maxSize);
-    
-    // Log the call stack
-    logStackTrace("QIODevice::write call stack");
-    
-    // Log the data to write
-    logMemory("Data to write", (void *)data, (size_t)(maxSize < 64 ? maxSize : 64));
-    
-    if (original_qIODevice_write) {
-        ssize_t result = original_qIODevice_write(self, data, maxSize);
-        NSLogger(@"[reMarkable] QIODevice::write result: %zd", result);
-        return result;
-    }
-    NSLogger(@"[reMarkable] WARNING: Original QIODevice::write not available, returning 0");
-    return 0;
-}
-
-extern "C" int64_t hooked_function_at_0x10015A130(int64_t a1, int64_t a2) {
-    NSLogger(@"[reMarkable] Hook at 0x10015A130 called!");
-    NSLogger(@"[reMarkable]   a1 = 0x%llx", (unsigned long long)a1);
-    NSLogger(@"[reMarkable]   a2 = 0x%llx", (unsigned long long)a2);
-
-    logMemory("Memory at a1", (void *)a1, 64);
-    logMemory("Memory at a2", (void *)a2, 64);
-
-    if (original_function_at_0x10015A130) {
-        int64_t result = original_function_at_0x10015A130(a1, a2);
-        NSLogger(@"[reMarkable]   result = 0x%llx", (unsigned long long)result);
-        return result;
-    }
-
-    NSLogger(@"[reMarkable] WARNING: Original function at 0x10015A130 not available, returning 0");
-    return 0;
-}
-
-extern "C" void hooked_function_at_0x10015BC90(int64_t a1, int64_t a2) {
-    NSLogger(@"[reMarkable] Hook at 0x10015BC90 called!");
-    NSLogger(@"[reMarkable]   a1 = 0x%llx", (unsigned long long)a1);
-    NSLogger(@"[reMarkable]   a2 = 0x%llx", (unsigned long long)a2);
-
-    logMemory("Memory at a1", (void *)a1, 64);
-    logMemory("Memory at a2", (void *)a2, 64);
-
-    if (original_function_at_0x10015BC90) {
-        original_function_at_0x10015BC90(a1, a2);
-        NSLogger(@"[reMarkable]   original function returned (void)");
-        return;
-    }
-
-    NSLogger(@"[reMarkable] WARNING: Original function at 0x10015BC90 not available");
-}
-
-extern "C" int64_t hooked_function_at_0x10016D520(int64_t a1, int64_t *a2, unsigned int a3, int64_t a4) {
-    NSLogger(@"[reMarkable] Hook at 0x10016D520 called!");
-    NSLogger(@"[reMarkable]   a1 = 0x%llx", (unsigned long long)a1);
-    NSLogger(@"[reMarkable]   a2 = %p", a2);
-    if (a2) {
-        NSLogger(@"[reMarkable]   *a2 = 0x%llx", (unsigned long long)*a2);
-    }
-    NSLogger(@"[reMarkable]   a3 = %u (0x%x)", a3, a3);
-    NSLogger(@"[reMarkable]   a4 = 0x%llx", (unsigned long long)a4);
-    
-    // Log memory contents using helper function
-    logMemory("Memory at a1", (void *)a1, 64);
-    logMemory("Memory at a2", (void *)a2, 64);
-    
-    if (a2 && *a2 != 0) {
-        logMemory("Memory at *a2", (void *)*a2, 64);
-    }
-    
-    logMemory("Memory at a4", (void *)a4, 64);
-    
-    if (original_function_at_0x10016D520) {
-        int64_t result = original_function_at_0x10016D520(a1, a2, a3, a4);
-        NSLogger(@"[reMarkable]   result = 0x%llx", (unsigned long long)result);
-        return result;
-    }
-    
-    NSLogger(@"[reMarkable] WARNING: Original function not available, returning 0");
-    return 0;
-}
-
-extern "C" void hooked_function_at_0x1001B6EE0(int64_t a1, int64_t *a2, unsigned int a3) {
-    NSLogger(@"[reMarkable] Hook at 0x1001B6EE0 called!");
-    NSLogger(@"[reMarkable]   a1 = 0x%llx", (unsigned long long)a1);
-    
-    // At a1 (PdfExporter object at 0x7ff4c17391e0):
-    // +0x10   0x000600043EC10    QString (likely document name)
-    NSLogger(@"[reMarkable] Reading QString at a1+0x10:");
-    logMemory("a1 + 0x10 (raw)", (void *)(a1 + 0x10), 64);
-
-    void **qstrPtr = (void **)(a1 + 0x10);
-    void *dataPtr = *qstrPtr;
-
-    if (!dataPtr) {
-        NSLogger(@"[reMarkable] QString has null data pointer");
-        return;
-    }
-
-    // try reading potential size fields near dataPtr
-    int32_t size = 0;
-    for (int delta = 4; delta <= 32; delta += 4) {
-        int32_t candidate = *(int32_t *)((char *)dataPtr - delta);
-        if (candidate > 0 && candidate < 10000) {
-            size = candidate;
-            NSLogger(@"[reMarkable] QString plausible size=%d (found at -%d)", size, delta);
-            break;
-        }
-    }
-
-    if (size > 0) {
-        NSString *qstringValue = [[NSString alloc] initWithCharacters:(unichar *)dataPtr length:size];
-        NSLogger(@"[reMarkable] QString value: \"%@\"", qstringValue);
-    } else {
-        NSLogger(@"[reMarkable] QString: could not find valid size");
-    }
-    
-    NSLogger(@"[reMarkable]   a2 = %p", a2);
-    if (a2) {
-        NSLogger(@"[reMarkable]   *a2 = 0x%llx", (unsigned long long)*a2);
-    }
-    NSLogger(@"[reMarkable]   a3 = %u (0x%x)", a3, a3);
-    
-    if (original_function_at_0x1001B6EE0) {
-        original_function_at_0x1001B6EE0(a1, a2, a3);
-        NSLogger(@"[reMarkable] Original function at 0x1001B6EE0 executed");
-    } else {
-        NSLogger(@"[reMarkable] WARNING: Original function not available");
-    }
-}
-#endif // BUILD_MODE_DEV
-
-@end

src/utils/MessageBroker.h

@@ -0,0 +1,63 @@
+// Credits: asivery/rm-xovi-extensions 
+// (https://github.com/asivery/rm-xovi-extensions/blob/master/xovi-message-broker/src/XoviMessageBroker.h)
+// Simplified for RMHook dylib <-> QML communication
+
+#pragma once
+
+#include <QObject>
+#include <QStringList>
+#include <QString>
+#include <QDebug>
+#include <QtQml/QQmlEngine>
+
+// Forward declaration
+class MessageBroker;
+
+// Native callback type for C++ listeners
+typedef void (*NativeSignalCallback)(const char *signal, const char *value);
+
+namespace messagebroker {
+    void addBroadcastListener(MessageBroker *ref);
+    void removeBroadcastListener(MessageBroker *ref);
+    void broadcast(const char *signal, const char *value);
+    void registerQmlType();
+    
+    // Register a native C++ callback to receive all signals
+    void setNativeCallback(NativeSignalCallback callback);
+}
+
+class MessageBroker : public QObject
+{
+    Q_OBJECT
+    Q_PROPERTY(QStringList listeningFor READ getListeningFor WRITE setListeningFor)
+
+public:
+    explicit MessageBroker(QObject *parent = nullptr) : QObject(parent) {
+        messagebroker::addBroadcastListener(this);
+    }
+
+    ~MessageBroker() {
+        messagebroker::removeBroadcastListener(this);
+    }
+
+    // Send a signal from QML to all listeners (including C++ side)
+    Q_INVOKABLE void sendSignal(const QString &signal, const QString &message) {
+        QByteArray signalUtf8 = signal.toUtf8();
+        QByteArray messageUtf8 = message.toUtf8();
+        messagebroker::broadcast(signalUtf8.constData(), messageUtf8.constData());
+    }
+
+    void setListeningFor(const QStringList &l) {
+        _listeningFor = l;
+    }
+
+    const QStringList& getListeningFor() const {
+        return _listeningFor;
+    }
+
+signals:
+    void signalReceived(const QString &signal, const QString &message);
+
+private:
+    QStringList _listeningFor;
+};

src/utils/MessageBroker.mm

@@ -0,0 +1,58 @@
+// Credits: asivery/rm-xovi-extensions 
+// (https://github.com/asivery/rm-xovi-extensions/blob/master/xovi-message-broker/src/XoviMessageBroker.h)
+
+#import <Foundation/Foundation.h>
+#include "MessageBroker.h"
+#include "Logger.h"
+#include <vector>
+#include <cstring>
+#include <algorithm>
+
+static std::vector<MessageBroker *> brokers;
+static NativeSignalCallback nativeCallback = nullptr;
+
+void messagebroker::setNativeCallback(NativeSignalCallback callback) {
+    nativeCallback = callback;
+    NSLogger(@"[MessageBroker] Native callback registered");
+}
+
+void messagebroker::addBroadcastListener(MessageBroker *ref) {
+    // Cannot have more than one.
+    if(std::find(brokers.begin(), brokers.end(), ref) == brokers.end()) {
+        brokers.push_back(ref);
+        NSLogger(@"[MessageBroker] Added broadcast listener, total: %zu", brokers.size());
+    }
+}
+
+void messagebroker::removeBroadcastListener(MessageBroker *ref) {
+    std::vector<MessageBroker *>::iterator iter;
+    if((iter = std::find(brokers.begin(), brokers.end(), ref)) != brokers.end()) {
+        brokers.erase(iter);
+        NSLogger(@"[MessageBroker] Removed broadcast listener, remaining: %zu", brokers.size());
+    }
+}
+
+void messagebroker::broadcast(const char *signal, const char *value) {
+    QString qSignal(signal), qValue(value);
+    NSLogger(@"[MessageBroker] Broadcasting signal '%s' with value '%s'", signal, value);
+    
+    // Call native C++ callback if registered
+    if (nativeCallback) {
+        nativeCallback(signal, value);
+    }
+    
+    // Notify QML listeners
+    for(auto &ref : brokers) {
+        if(ref->getListeningFor().contains(qSignal)) {
+            emit ref->signalReceived(qSignal, qValue);
+        }
+    }
+}
+
+void messagebroker::registerQmlType() {
+    qmlRegisterType<MessageBroker>("net.noham.MessageBroker", 1, 0, "MessageBroker");
+    NSLogger(@"[MessageBroker] Registered QML type net.noham.MessageBroker");
+}
+
+// Include MOC output for MessageBroker class (generated by Qt's Meta-Object Compiler)
+#include "moc_MessageBroker.cpp"

src/utils/ResourceUtils.h

@@ -3,6 +3,7 @@
 
 #include <stdint.h>
 #include <stdlib.h>
+#include <stdbool.h>
 
 #ifdef __cplusplus
 extern "C" {
@@ -19,6 +20,16 @@ struct ResourceRoot {
     int entriesAffected;
 };
 
+// Replacement entry for storing new data to be appended
+struct ReplacementEntry {
+    int node;
+    uint8_t *data;
+    size_t size;
+    size_t copyToOffset;
+    bool freeAfterwards;
+    struct ReplacementEntry *next;
+};
+
 #define TREE_ENTRY_SIZE 22
 #define DIRECTORY 0x02
 
@@ -35,8 +46,14 @@ void statArchive(struct ResourceRoot *root, int node);
 void processNode(struct ResourceRoot *root, int node, const char *rootName);
 void ReMarkableDumpResourceFile(struct ResourceRoot *root, int node, const char *rootName, const char *fileName, uint16_t flags);
 
+// Replacement utilities
+void addReplacementEntry(struct ReplacementEntry *entry);
+struct ReplacementEntry *getReplacementEntries(void);
+void clearReplacementEntries(void);
+void replaceNode(struct ResourceRoot *root, int node, const char *fullPath, int treeOffset);
+
 #ifdef __cplusplus
 }
 #endif
 
-#endif /* ResourceUtils_h */
+#endif

src/utils/ResourceUtils.m

@@ -36,7 +36,7 @@ static NSString *ReMarkableDumpRootDirectory(void) {
     return dumpDirectory;
 }
 
-#ifdef BUILD_MODE_QMLDIFF
+#ifdef BUILD_MODE_QMLREBUILD
 uint32_t readUInt32(uint8_t *addr, int offset) {
     return (uint32_t)(addr[offset + 0] << 24) |
            (uint32_t)(addr[offset + 1] << 16) |
@@ -344,6 +344,147 @@ void ReMarkableDumpResourceFile(struct ResourceRoot *root, int node, const char
     }
 }
 
+// List of files to process with replaceNode
+static const char *kFilesToReplace[] = {
+    "/qml/client/dialogs/ExportDialog.qml",
+    "/qml/client/settings/GeneralSettings.qml",
+    NULL  // Sentinel to mark end of list
+};
+
+static bool shouldReplaceFile(const char *fullPath) {
+    if (!fullPath) return false;
+    for (int i = 0; kFilesToReplace[i] != NULL; i++) {
+        if (strcmp(fullPath, kFilesToReplace[i]) == 0) {
+            return true;
+        }
+    }
+    return false;
+}
+
+// Get the path to replacement files directory
+static NSString *ReMarkableReplacementDirectory(void) {
+    static NSString *replacementDirectory = nil;
+    static dispatch_once_t onceToken;
+    dispatch_once(&onceToken, ^{
+        NSString *preferencesDir = ReMarkablePreferencesDirectory();
+        NSString *candidate = [preferencesDir stringByAppendingPathComponent:@"replacements"];
+        NSFileManager *fileManager = [NSFileManager defaultManager];
+        NSError *error = nil;
+        if (![fileManager fileExistsAtPath:candidate]) {
+            if (![fileManager createDirectoryAtPath:candidate withIntermediateDirectories:YES attributes:nil error:&error]) {
+                NSLogger(@"[reMarkable] Failed to create replacements directory %@: %@", candidate, error);
+            }
+        }
+        replacementDirectory = [candidate copy];
+    });
+    return replacementDirectory;
+}
+
+// Global linked list of replacement entries
+static struct ReplacementEntry *g_replacementEntries = NULL;
+
+void addReplacementEntry(struct ReplacementEntry *entry) {
+    entry->next = g_replacementEntries;
+    g_replacementEntries = entry;
+}
+
+struct ReplacementEntry *getReplacementEntries(void) {
+    return g_replacementEntries;
+}
+
+void clearReplacementEntries(void) {
+    struct ReplacementEntry *current = g_replacementEntries;
+    while (current) {
+        struct ReplacementEntry *next = current->next;
+        if (current->freeAfterwards && current->data) {
+            free(current->data);
+        }
+        free(current);
+        current = next;
+    }
+    g_replacementEntries = NULL;
+}
+
+void replaceNode(struct ResourceRoot *root, int node, const char *fullPath, int treeOffset) {
+    NSLogger(@"[reMarkable] replaceNode called for: %s", fullPath);
+    
+    if (!root || !root->tree || !fullPath) {
+        NSLogger(@"[reMarkable] replaceNode: invalid parameters");
+        return;
+    }
+    
+    // Build path to replacement file on disk
+    NSString *replacementDir = ReMarkableReplacementDirectory();
+    if (![replacementDir length]) {
+        NSLogger(@"[reMarkable] replaceNode: no replacement directory");
+        return;
+    }
+    
+    NSString *relativePath = [NSString stringWithUTF8String:fullPath];
+    if ([relativePath hasPrefix:@"/"]) {
+        relativePath = [relativePath substringFromIndex:1];
+    }
+    
+    NSString *replacementFilePath = [replacementDir stringByAppendingPathComponent:relativePath];
+    NSFileManager *fileManager = [NSFileManager defaultManager];
+    
+    if (![fileManager fileExistsAtPath:replacementFilePath]) {
+        NSLogger(@"[reMarkable] replaceNode: replacement file not found at %@", replacementFilePath);
+        return;
+    }
+    
+    // Read the replacement file
+    NSError *readError = nil;
+    NSData *replacementData = [NSData dataWithContentsOfFile:replacementFilePath options:0 error:&readError];
+    if (!replacementData || readError) {
+        NSLogger(@"[reMarkable] replaceNode: failed to read replacement file %@: %@", replacementFilePath, readError);
+        return;
+    }
+    
+    size_t dataSize = [replacementData length];
+    NSLogger(@"[reMarkable] replaceNode: loaded replacement file %@ (%zu bytes)", replacementFilePath, dataSize);
+    
+    // Allocate and copy the replacement data
+    uint8_t *newData = (uint8_t *)malloc(dataSize);
+    if (!newData) {
+        NSLogger(@"[reMarkable] replaceNode: failed to allocate %zu bytes", dataSize);
+        return;
+    }
+    memcpy(newData, [replacementData bytes], dataSize);
+    
+    // Create a replacement entry
+    struct ReplacementEntry *entry = (struct ReplacementEntry *)malloc(sizeof(struct ReplacementEntry));
+    if (!entry) {
+        NSLogger(@"[reMarkable] replaceNode: failed to allocate replacement entry");
+        free(newData);
+        return;
+    }
+    
+    entry->node = node;
+    entry->data = newData;
+    entry->size = dataSize;
+    entry->freeAfterwards = true;
+    entry->copyToOffset = root->dataSize;  // Will be appended at the end of data
+    entry->next = NULL;
+    
+    // Update the tree entry:
+    writeUint16(root->tree, treeOffset - 2, 0);  // Set flag to raw (uncompressed)
+    writeUint32(root->tree, treeOffset + 4, (uint32_t)entry->copyToOffset);  // Update data offset
+    
+    NSLogger(@"[reMarkable] replaceNode: updated tree - flags at offset %d, dataOffset at offset %d -> %zu", 
+             treeOffset - 2, treeOffset + 4, entry->copyToOffset);
+    
+    // Update dataSize to account for the new data (size prefix + data)
+    root->dataSize += entry->size + 4;
+    root->entriesAffected++;
+    
+    // Add to replacement entries list
+    addReplacementEntry(entry);
+    
+    NSLogger(@"[reMarkable] replaceNode: marked for replacement - %s (new offset: %zu, size: %zu)", 
+             fullPath, entry->copyToOffset, entry->size);
+}
+
 void processNode(struct ResourceRoot *root, int node, const char *rootName) {
     int offset = findOffset(node) + 4;
     uint16_t flags = readUInt16(root->tree, offset);
@@ -375,9 +516,42 @@ void processNode(struct ResourceRoot *root, int node, const char *rootName) {
 
         free(tempRoot);
     } else {
-        NSLogger(@"[reMarkable] Processing node %d: %s%s", (int)node, rootName ? rootName : "", nameBuffer);
-        uint16_t fileFlags = readUInt16(root->tree, offset - 2);
-        ReMarkableDumpResourceFile(root, node, rootName ? rootName : "", nameBuffer, fileFlags);
+        uint16_t fileFlag = readUInt16(root->tree, offset - 2);
+        const char *type;
+        if (fileFlag == 1) {
+            type = "zlib";
+        } else if (fileFlag == 4) {
+            type = "zstd";
+        } else if (fileFlag == 0) {
+            type = "raw";
+        } else {
+            type = "unknown";
+        }
+        
+        // Build full path: rootName + nameBuffer
+        const size_t rootLen = rootName ? strlen(rootName) : 0;
+        const size_t nameLen = strlen(nameBuffer);
+        char *fullPath = (char *)malloc(rootLen + nameLen + 1);
+        if (fullPath) {
+            if (rootLen > 0) {
+                memcpy(fullPath, rootName, rootLen);
+            }
+            memcpy(fullPath + rootLen, nameBuffer, nameLen);
+            fullPath[rootLen + nameLen] = '\0';
+            
+            NSLogger(@"[reMarkable] Processing node %d: %s (type: %s)", (int)node, fullPath, type);
+            
+            // Check if this file should be replaced
+            if (shouldReplaceFile(fullPath)) {
+                replaceNode(root, node, fullPath, offset);
+            }
+            
+            free(fullPath);
+        } else {
+            NSLogger(@"[reMarkable] Processing node %d: %s%s (type: %s)", (int)node, rootName ? rootName : "", nameBuffer, type);
+        }
+        
+        // ReMarkableDumpResourceFile(root, node, rootName ? rootName : "", nameBuffer, fileFlag);
     }
 }
-#endif // BUILD_MODE_QMLDIFF
+#endif // BUILD_MODE_QMLREBUILD