INT8 __stdcall RtlQueryProcessPlaceholderCompatibilityMode(){ _PEB *Peb; Peb = KeGetCurrentThread()->ApcState.Process->Peb; if( Peb ) return Peb->PlaceholderCompatibilityMode; else return -3; }