I have done some testing, and it looks like all of the info that the H9 sends to the H9 Control app (especially KNOB POSITION!) is sent via some non-MIDI communication protocol.
Yes, this is true. But you can also control the H9 via normal MIDI CC messages. You're trying to figure out what the H9 sends H9 Control so you know what the current knob position is for each knob?
No, we don't have a mechanism for relative value changes; you can send a MIDI CC to control a parameter but that will cause an absolute value change.