Since v4.5 protection was removed from kernel. Only SFFS and CD check were done in kernel. SFFS easy to hook in kernel and unpack by injecting own dll into target process. Other stuff(VM) done completely in user mode. And current v5.7 is driver less because using internet activation which is not require any drivers but still may use SFFS which is driver based.