Hidden windows & anti-capture

Three-part series: HWND-level DisplayAffinity, DWM Visual-layer hiding, then BitBlt-style capture compared to composed output.

Part 1: SetWindowDisplayAffinity — mechanism & detection
win32kfull chain → DWM CWindowContext → memory signatures & detection limits
Part 2: Visual-layer hiding — mechanism & detection
dwmcore!CVisual, HasProtectedContent, heap vtable scan & PID attribution
Part 3: BitBlt “super screenshot” — DWM readback mode
BitBlt → RenderForCapture, g_pComposition + 0x196A, Lab patch