Disabling SIP on VMs for the Private API
Sometimes VMs can be a bit finnicky to disable SIP - oftentimes you will only end up with SIP partially disabled when running
csrutil disablein the terminal.
Here are some steps that have worked for our users running various different VMs
- 1.Mount the EFI Partition using OpenCore
- 2.Open the config.plist file in the OC folder (I opened in OpenCore)
- 3.Create two entries:
- 1.NVRAM -> Delete -> 7C436110-AB2A-4BBB-A880-FE41995C9F82 -> csr-active-config
- 2.NVRAM -> Add -> 7C436110-AB2A-4BBB-A880-FE41995C9F82 -> csr-active-config: Value: 67000000
- 1.Start by booting to macOS and opening a Terminal application window. Next, enter the command given below. This will create a NVRAM variable with the desired value, but misspelled variable name. This misspelling will be corrected in a later step.sudo nvram Asr-active-config=%7f%00%00%00
- 2.Shutdown macOS. Add the following to the bottom of the VMX file:bios.forceSetupOnce = "TRUE"Save the VMX file and boot up macOS.
- 4.Set the current filesystem to the EFI volume. This should be the mapped
fs0filesystem, so you would enter the followingfs0:Next, verify the label is
EFIby entering the command below.volIf wrong, then try
- 5.Enter the command below to save the
Asr-active-configvariable to the file
csr.bin.dmpstore Asr-active-config -s csr.binNext, enter the command below to edit the
csr.binfile.hexedit csr.binYou will need to correct the spelling by replacing the letter
Awith the letter
c. The can be done by typing a
41on the first line. The corrected file will appear as shown below. When finished save the changes and exit.Enter the command below to create the
csr-active-configvariable in NVRAM.dmpstore -l csr.binSIP will now be disabled on the next boot of macOS. If desired, enter the command below to remove the
Asr-active-configvariable from NVRAM.dmpstore -d Asr-active-config
- 6.Enter the command below to leave the command shell.exitFrom the
Boot Manager, select
Mac OS Xto boot macOS.
- 1.Shutdown your VM
- 2.Choose Power on to Firmware from the Virtual Machine menu
- 3.Select “Enter Setup”
- 4.Boot from a file
- 5.Arrow down to Recovery HD
- 6.Hit enter until you can pick
- 8.Hit enter
- 9.You are now in recovery mode - open terminal from the Utilities menu, type
csrutil disable, and reboot your VM.
SIP should now be disabled and you can proceed with setting up the Private API!