RtlSetThreadPlaceholderCompatibilityMode - NtDoc

Native API online documentation, based on the System Informer (formerly Process Hacker) phnt headers 
#ifndef _NTRTL_H
//
// Cloud Filters
//
#if (PHNT_VERSION >= PHNT_WINDOWS_10_RS3)

/**
 * The RtlSetThreadPlaceholderCompatibilityMode routine sets the placeholder compatibility mode for the current thread.
 *
 * \param Mode The placeholder compatibility mode to set.
 * \return CHAR The previous thread placeholder compatibility mode.
 * \remarks These operate on thread/process compatibility state rather than a file. Signed sentinel return values are meaningful; do not treat them as NTSTATUS or as ordinary BOOLEAN results. Process-wide changes can affect unrelated file operations.
 */
NTSYSAPI
CHAR
NTAPI
RtlSetThreadPlaceholderCompatibilityMode(
    _In_ CHAR Mode
    );

#endif
#endif

View code on GitHub
// ntifs.h

NTSYSAPI CHAR RtlSetThreadPlaceholderCompatibilityMode(
  [in] CHAR Mode
);
View the official Windows Driver Kit DDI reference

NtDoc

This function is documented in Windows Driver Kit.

Edit description on GitHub

Windows Driver Kit DDI reference (nf-ntifs-rtlsetthreadplaceholdercompatibilitymode)

RtlSetThreadPlaceholderCompatibilityMode function

Description

RtlSetThreadPlaceholderCompatibilityMode sets the placeholder compatibility mode for the current thread. This allows a thread to explicitly request that placeholder files be either disguised or exposed, overriding the application’s default mode for that thread only.

Parameters

Mode [in]

Specifies the placeholder compatibility mode to set.

Return value

Returns the thread's previous placeholder compatibility mode. If there was an error it returns a negative value. It can be one of the following values:

Compatibility Mode Value
PHCM_APPLICATION_DEFAULT 0
PHCM_DISGUISE_PLACEHOLDER 1
PHCM_EXPOSE_PLACEHOLDERS 2
PHCM_MAX 2
PHCM_ERROR_INVALID_PARAMETER -1
PHCM_ERROR_NO_TEB -2

Remarks

When placeholders are exposed, characteristics such as the presence of a reparse point, the sparse bit, and the offline bit are plainly visible through directory enumeration and other types of file information queries. When placeholders are disguised, these details are completely hidden, making the file look like a normal file.

Most Windows applications see exposed placeholders by default. For compatibility reasons, Windows may decide that certain applications see disguised placeholders by default.

See also

RtlQueryProcessPlaceholderCompatibilityMode

RtlQueryThreadPlaceholderCompatibilityMode

RtlSetProcessPlaceholderCompatibilityMode

View the official Windows Driver Kit DDI reference

Edit description on GitHub