OpenCore csr-active-config problem

[tom111]

How can I set the csr-active-config NVRAM variable?
I have set the csr-active-config to FF070000 Type DATA in the config.plist, in order to deactivate System Integrety Protection.
But when I check the NVRAM variables with Hackintool it still set to 00000000.
When I set a test variable from the Terminal it is working, but trying to set csr-active-config gives an error message: "nvram: Error setting variable - 'csr-active-config': (iokit/common) not permitted"
What could be the problem?
How can I fix this?

 

[jaymonkey]

When I set a test variable from the Terminal it is working, but trying to set csr-active-config gives an error message: "nvram: Error setting variable - 'csr-active-config': (iokit/common) not permitted"

@tom111,

You can not set the csr-active-config value using the standard nvram terminal command as it is a protected system variable, to set it via a terminal command you must boot into recovery and run terminal from the "Utilities" menu and then use the csrutil command, it can not be done from within MacOS.

Method:

1. Boot into Recovery
2. Run Terminal from the "Utilities" menu
3. Enter the command: csrutil disable; reboot
4. The system should reboot with SIP disabled

I have set the csr-active-config to FF070000 Type DATA in the config.plist, in order to deactivate System Integrety Protection.But when I check the NVRAM variables with Hackintool it still set to 00000000.

I'm not sure why it's not working for you by setting the csr-active-config NVRAM variable in OC's config.plist.
That said FF070000 is not a value i'm familiar with, generally we use these values for csr-active-config :-

00000000 - SIP completely enabled
03000000 - Allow unsigned kexts and writing to protected system file locations
67000000 - SIP completely disabled

You could try using OC sanity checker to see if you have any syntax errors in your config.plist

OpenCore config.plist Sanity Checker

Sanity check your OpenCore config.plist

opencore.slowgeek.com

Cheers
Jay

 

[oli.mathieu]

@tom111,
Have you tried This SSDT from Dortania's guide ?

 

[tom111]

Sanity Checker is not showing any syntax errors.
I will check the SSDT. Settings test variables is working.

 

[tom111]

Meanwhile I found the solution for the csr-active-config problem.
It has to be added to the NVRAM - Delete section in the config.plist. Then it will be written to the NVRAM.

 

[Henties]

@tom111 @jaymonkey
The opencore NVRAM csr-active-config variable - placeholder - can be set on the fly without the need to boot into the recovery partition first.

1. In the opencore config.plist NVRAM section under Delete --> 7C436110-AB2A-4BBB-A880- FE41995C9F82 add an entry as per my position 2 of the attached screenshot.

7C436110-AB2A-4BBB-A880-FE41995C9F82 --> 2 --> String --> csr-active-config

This entry ensures that the contents of NVRAM placeholder csr-active-config, gets deleted during every reboot.

2. Under NVRAM --> Add --> 7C436110-AB2A-4BBB-A880-FE41995C9F82 --> csr-active-config --> Data you can now plug in any valid opencore SIP value that you wish your system should be controlled by. This value takes effect during every reboot. ie. a value first gets deleted and then immediately replaced again by whatever value has been set for csr-active-config, valid or not.

3. Valid Big Sur entries for SIP - csr-active-config - are:

ff0f0000 fully off
00000000 fully on

For macOS, up to and including Catalina, use the values that @jaymonkey has provided earlier.

Note: With every reboot I delete and rewrite all the NVRAM variable placeholders available with a standard sample.plist file provided by the opencore developers, hence the 5 entries under the Delete section of the screenshot of my particular config.plist file.


Greetings Henties

 

[tom111]

@tom111 @jaymonkey
The opencore NVRAM csr-active-config variable - placeholder - can be set on the fly without the need to boot into the recovery partition first.

1. In the opencore config.plist NVRAM section under Delete --> 7C436110-AB2A-4BBB-A880- FE41995C9F82 add an entry as per my position 2 of the attached screenshot.

Ehem, that is what I have written in the post directly in front of yours.
But thanks for describing it once again in more detail.

 

[Henties]

@tom111 Yes, I was aware of that, however my post was not only directed at you, in essence I added all that for the benefit of others, and also for the sake of completeness, because few "board members" seem to be aware of this particular smart opencore feature, and especially the way to implement this.

Personally I wish that people in general provide more detailed responses to "hacker" queries as
opposed to meaningless responses that serve only one purpose which is to rapidly increase their respective message count.

Greetings Henties

 

[Deleted member 2151140]

Thanx for That NVRAM CSRUTIL thing, could not figure out that Picker shows me Boot entry for Recovery.....
And needet that for USB WLAN Install.........

Have Now Big Sur on:

HP 440 G5
HP 8300 -AMD WX41000

Very fast with OpenCore 0.6.3

If Anybody needs an EFI........

 

[simo241]

I had to delete the entry from open core plist because the update was not showing, now i am issue the problem of the icon that is moving every time i boot from shut down , how can i solve