Not sure what you mean by "jmp_ntoskrnl.exe".
Seems to me that it's just a notation used by your tool to imply an imported function from ntoskrnl.exe.
I think the most siginificant change after rev 809 is the addtion of PsCreateSystemThread.
They now start a system thread to monitor wether someone has uninstalled their hook.
So, one of the first thing to do in disabling GG, would be to hook PsCreateSystemThread.
If inline hooking appears to be too difficult, simple IAT hooking would work as well.

PsSetCreateProcessNotifyRoutine is easy to defeat.  In your driver, just call the function and iterate through all possible kernel address with the second parameter set to TRUE. (That also disables CE's process watcher, so for CE to work, you'd have to exclude CE's driver address range)

Kernel address usually range from 0x80000000 and above.  So, the basic code would be:

for(i = 0x80000000; i < 0xFFFFFFFF; i++){
    PsSetCreateProcessNotifyRoutine((PCREATE_PROCESS_NOTIFY_ROUTINE)i, TRUE);
}

That's the basic form.  It will remove ALL notify routines in the kernel.(execution takes a few minute...slow!)

To exclude CE:
for(i = 0x80000000; i < 0xFFFFFFFF; i++){
    if( i >= CE_DriverBase && i <= (CE_DriverBase + CE_DriverSize) ) continue;
    PsSetCreateProcessNotifyRoutine((PCREATE_PROCESS_NOTIFY_ROUTINE)i, TRUE);
}

Or, you can disable it only for GG like this:
for( i = Dump_wmimmc_Base; i < (Dump_wmimmc_Base + Dump_wmimmc_Size); i++){
    PsSetCreateProcessNotifyRoutine((PCREATE_PROCESS_NOTIFY_ROUTINE)i, TRUE);
}

To exclude or target specific driver, you must find their address range, but it's trivial.  (for CE, just peek into its DriverObject, for dump_wmimmc.sys, use PsSetLoadImageNotifyRoutine)

You can also render PsSetCreateProcessNotifyRoutine useless by filling up all 8 slots with dummy routines before GG loads dump_wmimmc.sys.

Well, it's easy, ....which means defeating PsSetCreateProcessNotifyRoutine won't disturb GG much

You can definitely trap GG's IOCTL request, but that doesn't prevent GG from scanning other processes.

Two ways that I can think of to disable memory scanning...
1. hook NtOpenProcess (not from SDT, but by function entry point overwriting)
2. use DKOM method as in FUTo rootkit.  http://uninformed.org/?v=3&a=7&t=sumry
The latter method is better, but it's complicated.

as long as we dont leak the UCE, it should be able to stay alive for quite a few GG versions

Probably, but we gotta find out how it communicate with maplestory.exe