#ifndef _NTRTL_H
#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS4)

/**
 * The RtlQueryProcessPlaceholderCompatibilityMode routine returns the placeholder compatibility mode for the current process.
 *
 * \return CHAR The current process placeholder compatibility mode.
 * \remarks These operate on thread/process compatibility state rather than a file. Signed sentinel return values are meaningful; do not treat them as NTSTATUS or as ordinary BOOLEAN results. Process-wide changes can affect unrelated file operations.
 */
NTSYSAPI
CHAR
NTAPI
RtlQueryProcessPlaceholderCompatibilityMode(
    VOID
    );

#endif
#endif
View code on GitHub

// ntifs.h

NTSYSAPI CHAR RtlQueryProcessPlaceholderCompatibilityMode();
View the official Windows Driver Kit DDI reference

NtDoc

This function is documented in Windows Driver Kit.

Edit description on GitHub

Windows Driver Kit DDI reference (nf-ntifs-rtlqueryprocessplaceholdercompatibilitymode)

RtlQueryProcessPlaceholderCompatibilityMode function

Description

RtlQueryProcessPlaceholderCompatibilityMode returns the placeholder compatibility mode for the current process.

Return value

This function returns the process's placeholder compatibility mode (PHCM_xxx), or a negative value on error (PCHM_ERROR_xxx). Contains one of the following values:

Compatibility Mode	Value
PHCM_APPLICATION_DEFAULT	0
PHCM_DISGUISE_PLACEHOLDER	1
PHCM_EXPOSE_PLACEHOLDERS	2
PHCM_MAX	2
PHCM_ERROR_INVALID_PARAMETER	-1
PHCM_ERROR_NO_TEB	-2

Remarks

This function is similar to RtlQueryThreadPlaceholderCompatibilityMode, but performs at a process level instead of a thread level.