Yes, all known antispyware apps usually hook win32k functions to block
BitBlt/… functions.
Usually they hook NtGdiBitBlt fn, but they forget to handle
NtGdiBitBltInternal fn for Win7/Win8 (this fn is called in internel win32k
functions, alt+prtscr/prtscr, scrolling, etc).
This won’t work for Win8 x64, because Win8 Kernel Patch Protection checks
win32k’s ssdt table and win32k image.
If you don’t need to map HDC to WND/PID, then you can play with DrvBitBlt
callback, but I think you won’t be able to say if this fn copies from
desktop or window.
This research is good to see how win32k/gdi “works”, but I don’t recommend
you to use it in commercial software.