> How about the case where the hardware doesn't support it. Would screen-grabbing be possible then? Where will the decryption take place in that case?

There essentially are several tiers of DRM

  - hardware-assisted encrypted pipelines (described above)
  - kernel module assisted
  - pure userspace obfuscated code

If it's in userspace, such as some software DVD players or game DRM then you can use a debugger to dump the keys or maybe hook some method that sends the frames to the gfx card.

If it's kernel-assisted you would have to bypass kernel module signing and hook deep into the operating system because the OS will also prevent screengrabbing of the protected surface.

If it is hardware assisted you will have to find a flaw somewhere in the pipeline or buy devices that contain decryption chips that basically are repurposed official decryption chips.