I think that disabling SIP can break some programs and it's hard to do for a normal user right? I'm curious how anti-malware software is doing this, because it's doing a lot of fancy stuff, maybe I should look into it by reverse engineering one of them. Thanks for the link I'll definitely check it out.