If an application is dynamically linked then the simplest way is to substitute one of Qt libraries or Qt plugins with your own (the latter is probably easiest). Listing objects and their properties is trivial then thanks to QApplication::topLevelWindows(), QObject::findChildren() and QMetaObject. To try to compensate this the application provider can use the "build key" feature of Qt, do some signing or encryption or link statically. Then you can still probably substitute the language runtime in some cases.