[fxtentacle]

Roughly yes.

I believe you can also in some instances skip the hardware capture card and instead capture the data stream out of the host's RAM.

Inside the monitor, the decryption module and the main SoC controlling the hardware are usually the same physical chip, so grabbing data there will be close to impossible.