#ifndef _NTRTL_H
//
// Cloud Filters
//
#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS3)

/**
 * The RtlQueryThreadPlaceholderCompatibilityMode routine returns the placeholder compatibility mode for the current thread.
 *
 * \return CHAR The current thread placeholder compatibility mode.
 * \remarks These operate on thread/process compatibility state rather than a file. Signed sentinel return values are meaningful; do not treat them as NTSTATUS or as ordinary BOOLEAN results. Process-wide changes can affect unrelated file operations.
 */
NTSYSAPI
CHAR
NTAPI
RtlQueryThreadPlaceholderCompatibilityMode(
    VOID
    );

#endif
#endif
View code on GitHub

// ntifs.h

NTSYSAPI CHAR RtlQueryThreadPlaceholderCompatibilityMode();
View the official Windows Driver Kit DDI reference

NtDoc

This function is documented in Windows Driver Kit.

Edit description on GitHub

Windows Driver Kit DDI reference (nf-ntifs-rtlquerythreadplaceholdercompatibilitymode)

RtlQueryThreadPlaceholderCompatibilityMode function

Description

RtlQueryThreadPlaceholderCompatibilityMode returns the placeholder compatibility mode for the current thread.

Return value

Returns the thread's placeholder compatibility mode. If there was an error it returns a negative value. It can be one of the following values:

Compatibility Mode	Value
PHCM_APPLICATION_DEFAULT	0
PHCM_DISGUISE_PLACEHOLDER	1
PHCM_EXPOSE_PLACEHOLDERS	2
PHCM_MAX	2
PHCM_ERROR_INVALID_PARAMETER	-1
PHCM_ERROR_NO_TEB	-2

Remarks

This function is similar to RtlQueryProcessPlaceholderCompatibilityMode, but performs at a thread level instead of a process level.