I have Big Sur installed in a VMware Fusion Player virtual machine. I desire to disable SIP. With an actual physical Mac, the usual method would involve first booting to internal macOS Recovery, then entering the command given below in a Terminal window.

csrutil disable

However, booting to internal macOS Recovery does not seem possible. The holding down the +R key combination at startup does not work. The Mac Startup Manager does not appear to exist. I can restart to firmware, but the Recovery volume does not have a boot.efi which can be chosen to boot from.

I realize the SIP setting is stored in the 4 byte NVRAM variable given below.


The firmware does allow booting to a built‑in EFI 1.0 shell. However, this shell does not appear to have any commands which can modify this variable. In fact, the variable does not even currently exist in the virtual machine NVRAM. I tried entering the command below in a macOS Terminal window.

 sudo nvram csr-active-config=%7f%00%00%00

The result was the error message given below.

nvram: Error setting variable - 'csr-active-config': (iokit/common) not permitted

What procedures can be used used to disable SIP?

I am using the current free version of VMware Fusion Player (Version 12.1.0).

Host Stats Guest Stats
iMac (21.5-inch, Late 2013) Mac
macOS Catalina version 10.15.7 macOS Big Sur version 11.6.1
Memory: 16 GB Memory: 4 GB
Quad-Core Intel Core i5 2 processor cores
2.9 GHz 2.76 GHz
USB 3 (5 Gb/s) Samsung T7 SSD SATA HDD

Below are a links to sites with procedures that either I could not get to work or only work with previous versions of macOS.

Can I initiate a MacOS restart to Recovery mode solely from the command line?
how to disable SIP (system integrity protection) in vmware fusion 12 for macOS big sur?

  • I don't have VMware so I can't try it out, but have you looked at the answer in: communities.vmware.com/t5/VMware-Fusion-Discussions/… Mar 6, 2021 at 8:33
  • The problem with the linked answer you provide is there is no boot.efi file. I posted this in my question. The the previous versions of macOS have this boot.efi file, but not Big Sur. Mar 6, 2021 at 8:40
  • 1
    Sorry, here's another thing you could try: communities.vmware.com/t5/VMware-Fusion-Discussions/… Mar 6, 2021 at 8:48
  • I was aware of this link. Basically, you create a macOS installer on either a virtual USB drive of virtual optical media. Next, boot from the drive or media and open a Terminal window where the csrutil disable command can be entered. The procedure for creating both the drive and media is complex and the time needed to boot is fairly long. I was hoping for something simpler and faster. You can post as an answer, but I would consider this to be a answer of last resort. Mar 6, 2021 at 9:08
  • 1
    VMware Fusion has to create a temporary installer on a second vHDD and I always make a copy of the initial installer and VM by selecting Customize so it doesn't immediately start the install. Then later this installer vHDD can be added back to the VM so as to access macOS Recovery when needed. Mar 6, 2021 at 14:57

6 Answers 6


Follow the steps below to disable System Integrity Protection (SIP).

  1. Start by booting to macOS Big Sur and opening a Terminal application window. Next, enter the command given below. This will create a NVRAM variable with the desired value, but misspelled variable name. This misspelling will be corrected in a later step.

    sudo nvram Asr-active-config=%7f%00%00%00
  2. Shutdown macOS. In the Setting window for the virtual machine, select Startup Disk. Hold down the option key and select the Restart to Firmware… button, as shown below.

    Select the EFI Internal Shell, as shown below.

    If desired, enter the command below to get full use of the window.

    mode 128 40
  3. Set the current filesystem to the EFI volume. This should be the mapped fs0 filesystem, so you would enter the following


    Next, verify the label is EFI by entering the command below.


    If wrong, then try fs1:, fs2:, fs3:, ....

  4. Enter the command below to save the Asr-active-config variable to the file csr.bin.

    dmpstore Asr-active-config -s csr.bin

    Note: For more information on this command enter help -b dmpstore.

    Next, enter the command below to edit the csr.bin file. You will need to correct the spelling by replacing the letter A with the letter c. The can be done by typing a 63 over the 41 on the first line.

    hexedit csr.bin

    The corrected file will appear as shown below. When finished save the changes and exit.

    Note: The value of the variable is stored in the last 4 bytes of this file.

    Enter the command below to create the csr-active-config variable in NVRAM.

    dmpstore -l csr.bin

    SIP will now be disabled on the next boot of Big Sur. If desired, enter the command below to remove the Asr-active-config variable from NVRAM.

    dmpstore -d Asr-active-config
  5. Enter the command below to leave the command shell.


    From the Boot Manager, select Mac OS X to boot Big Sur.

Format of the csr.bin File

Offset in Hex Size in Decimal Description
00-03 4 Length of variable name
04-27 36 Variable name stored as null terminated UTF-16LE string
28-37 16 GUID of the variable
38-3B 4 Attributes stored as 4 byte integer (See below)
3C-3F 4 Length of the data
40-43 4 The 4 byte integer that comprises the data
Attribute Value Description
NV 1 Non-volatile
BS 2 Boot service Access
RT 4 Runtime Access
HR 8 Hardware Error Record
  • 2
    Wow. This is nuts. Why the heck doesn’t VMWare provide an easier way to do this?! Mar 6, 2021 at 14:49
  • Does sudo nvram Asr-active-config=%7f%00%00%00 actually do anything? Mar 6, 2021 at 14:50
  • 2
    @Wowfunhappy: There is an easier way. You can install an UEFI Shell (v2.2). This shell has a setvar command which can modify the NVRAM variables used by macOS. Currently, Fusion Player has a built-in EFI Shell (v1.0). This shell has a set command which can only modify environment variables. There is no setvar command. BTW, VirtualBox has a built-in UEFI shell (v2.2). Mar 6, 2021 at 15:37
  • 1
    @Wowfunhappy: The sudo nvram Asr-active-config=%7f%00%00%00 command causes the variable to be created under a misspelled name. This was necessary, because the Big Sur nvram command will not accept the csr-active-config name. This misspelling will be corrected once the built-in EFI Shell is invoked. Mar 7, 2021 at 0:17

While this answer does provide a method for disabling SIP, I consider the method to be overly complicated, if sole purpose is to disable SIP. Also, the time need to boot is longer than booting to an EFI or UEFI shell. However, if there are other tasks that also need to be performed from a macOS Recovery environment, then this method may be preferred over simpler methods.

On a actual Mac, SIP can be disabled by entering the command csrutil disable in a Terminal window while booted from a USB flash drive macOS installer. Apple has a website providing the instructions for creating this USB flash drive macOS installer. VMware Fusion Player does not offer virtual USB drives. However, a virtual second internal drive can be substituted. The steps needed to create this virtual drive are given below.

Note: For the better view of the images, either click on the image or open the image in a new window.

  1. Aquire the installer application: If the Install macOS Big Sur application does not already exist in the Applications folder on the host, then download the application or transfer a copy from another Mac. This answer assumes the macOS version is 11.6.1.

  2. Create the installer disk image: On the host, open the Disk Utility. From the Disk Utility menu bar, select File>New Image>Blank Image…. In the popup choose the following, the select the Save button.

    After the disk image creation operation completes successfully, select the Done button. Next, open a Terminal application window on the host and enter the command below.

    sudo /Applications/Install\ macOS\ Big\ Sur.app/Contents/Resources/createinstallmedia --volume /Volumes/MyVolume

    When finished creating the Install macOS Big Sur volume, use the Disk Utility to eject all disk images. Quit the Disk Utility and Terminal applications.

  3. Set up sharing: With the client shutdown, open the Sharing pane of the Settings for the client. Check off the box labeled Enable Shared Folders and add your Desktop folder, as shown below.

  4. Create new internal HDD: With the client still shutdown, add a new hard disk. Use the settings shown below.

  5. Separate the new HDD from the client: This is an optional step which is useful if you what to share the new HDD with other virtual machines.

    Note: This sharing assumes only one client at a time with be using this drive. Otherwise, this drive should be mounted read-only. (This may be possible by editing the /etc/fstab file.

    First, remove the new HDD from the client. When the pop below appears, select the Keep File button.

    Use the Finder application to move the Virtual Disk 2.vmdk file from the client folder to the parent folder named Virtual Machines. Next, rename the file to BigSur11.6.1Installer.vmdk. Finally, add this new HDD to the client as an existing HDD. When selecting the file, be sure the Share this virtual disk with the virtual machine that created it button is selected, as shown below.

  6. Initialize the new HDD: Start up the client virtual machine. When the popup below appears, select the Initialize… button. The Disk Utility application should open.

    Highlight the new uninitialized VMware Virtual SATA Hard Drive Media and then select the Erase button. Make the selections shown below, then select the Erase button.

    Quit the Disk Utility.

  7. Install VMware Tools: If VMware Tools is already installed, then skip to the next step. From the VMware Fusion menu bar, select Virtual Machine>Install VMware Tools. Proceed to install. If either of the two windows below requests a Restart, do not do so.

    The system software from developer "VMware, Inc." will be blocked from loading. You should select the Allow button from the Security & Privacy pane of System Preferences, when this happens. Afterwards, when the window shown below requests a Restart, then you should do so.

  8. Restore to the new drive: From the client, open your Desktop folder stored on the host, then open the BigSur11.6.1Installer.dmg file. On the client, open the Disk Utility application and highlight the MyVolume volume. From the top of the Disk Utility window, select Restore. In the popup, select to restore from Install macOS Big Sur, then select the Restore button.

    Note: On my Mac, the restore took about 8 minutes.

    When finished, select the Done button. From the Disk Utility, eject the Disk image with the Install macOS Big Sur volume, then quit the Disk Utility. Close any open Finder windows.

  9. Cleanup: From the host, move the BigSur11.6.1Installer.dmg file from your Desktop folder to the Trash. If desired, restore Shared Folders to its original state.

To boot from new macOS installer drive, take the following steps.

  1. Shutdown the client.
  2. From the host, open the Startup Disk pane of the Settings for the client.
  3. Highlight the HDD icon labeled Hard Disk 2 (SATA).
  4. Select the Restart… button.

Alternative Way to Boot in Recovery Mode with Big Sur

Just to share my tryout after reading first post of David Anderson who helped me to find this.

The environment it's little different from VMW Fusion, actually it is this:
Guest OS: Big Sur 11.6
Host OS: Big Sur 11.6 on MBA 2020 (Intel)
Hypervisor: Virtual Box 6.1.28

I have tried every way to boot in Recovery Mode, either using nvram, or through EFI Internal Shell, all with no success (within my environment).

  • sudo nvram "recovery-boot-mode=unused" ==> With this old (Catalina) var, I even get “Error setting variable” in Big Sur.
  • sudo nvram internet-recovery-mode=RecoveryModeDisk ==> when rebooting GuestOS, seems variable to be ignored as MBA don't actually boot in Recovery Mode.
  • dmpstore -l csr.bin ==> returns “No matching variable found.”

And also booting in EFI Internal Shell and looking for CoreServices/boot.efi, I searched through all FSN: mapping table entries (all vols/partitions of local internal Disk of MBA), with no success. It seems System/Library/CoreServices is hidden or encrypted (SSV?)

Then, as suggested by t0rr3sp3dr0 here in GitHub, tried to look for CoreServices boot.efi, this way and I did as follow:

  • In VirtualBox under VM Settings —> Storage, mount Big Sur Installation image. And check “Live CD/DVD” option.
  • Start VM and press ESC key
  • Choose Boot Manager —> EFI Internal Shell
  • Look for Recovery Partition, in my environment under FS7, type:
    to check for HFS+.
  • Type:
    cd System/Library/CoreServices

enter image description here

Finally, my GuestOS (BigSur 11.6) boots in Recovery Mode!
Hope might help.

  • Your answer is for booting an optical version of the macOS Big Sur installer in VirtualBox. My question is how to disable SIP when using VMware. I do not see the relevance of your answer. You might consider posting your own question, then posting this answer to your own question. Oct 25, 2021 at 9:41
  • You are aware that VirtualBox does not fully support Big Sur, where as VMware does fully support Big Sur. Also, VMware is now a free product if used for personal purposes. Also, you can have both products installed at the same time. Oct 25, 2021 at 9:50
  • In your answer, you first boot to an UEFI Interactive Shell v2.2, then boot from the optical media. Why not just disable SIP while booted to the shell and skip using the optical media? I already posted the instructions back in March. See this answer. Since VirtualBox already has a Shell v2.2, rEFInd is not needed. Oct 25, 2021 at 10:36
  • Dear DA, many thx for comments and I was simply looking for something really close to your Q&A, as you stated in your question “but the Recovery volume does not have a boot.efi which can be chosen to boot from.”. And these are also 2 point I also had: disable SIP and Recovery Boot. And your post are great, they helped me and a lot of other people.
    – villoez
    Oct 25, 2021 at 14:16
  • Only thing I’m managing it with VirtualBox, but main questions are the same. If you prefer, I’ll detach and write a Q&A by myself. When you’re looking for something not all the times you’ll find a specific post for your specific answer, my intention only was to share my little tryout hoping it might help someone. Yes, I’m aware regarding your comment on VMW. Actually I currently am using VMW Workstation on Windows for lots of years, but I don’t have Fusion on macOS yet, sorry.
    – villoez
    Oct 25, 2021 at 14:18

This answer relies on having first installed an UEFI Shell v2.2. See this answer for instructions on how to use rEFInd to invoke an UEFI shell.

Choose one of two bulleted procedures below to install the csrutil UEFI shell alias.

  • Enter the command below in a UEFI shell. Since this alias is nonvolatile, the command will only needed to be entered once.

     alias csrutil "setvar csr-active-config -nv -rt -bs -guid 7C436110-AB2A-4BBB-A880-FE41995C9F82"
  • Install the startup.nsh file as described in the referenced answer. This script will create a volatile form of alias shown above each time a UEFI shell is invoked.

To modify the System Integrity Protection configuration, enter the commands in the "UEFI Shell Equivalent" column below in a UEFI shell.

macOS Command UEFI Shell Equivalent Description
csrutil clear csrutil = Clear the existing configuration.
csrutil disable csrutil =0x0000007f Disable the protection on the machine.
csrutil enable csrutil =0x00000010 Enable the protection on the machine.
csrutil status csrutil Display the current configuration.

Note: Once the csr-active-config variable is set, you can enable/disable SIP directly from rEFInd.

The bits of the csr-active-config variable are defined in the csr.h file. A version of this file can be found in opensource.apple.com. This developer.apple.com thread defines some additional csrutil arguments for the enable command. The relationship between these bits and select csrutil commands and arguments is given in the table below for macOS Big Sur version 11.6.1.

Note: The table below also applies to macOS Monterey version 12.0.1.

enable 0x00000010
enable ‑‑no‑internal 0x00000000
enable ‑‑without
enable ‑‑without
enable ‑‑without
enable ‑‑without
enable ‑‑without
disable 0x0000007F


  • how come enable ‑‑without fs and enable ‑‑without debug are the same? Shouldn't enable ‑‑without debug be 0x00000018?
    – startergo
    Jun 5, 2021 at 1:05
  • @startergo: I updated my answer for macOS 11.6.1. The csrutil enable --without debug now results in car-active-config being set to 0x00000014. I changed the table to reflect this. Oct 29, 2021 at 1:31

I had the same issue and I had rage quit a few times. :)

  1. In VMWare settings, create a new hard disk of at least 16 GB and attach to the guest macOS VM.

  2. Boot the macOS VM and format the new hard disk in the guest macOS VM as JHFS+ (not APFS), which is also known as "Mac OS Extended (Journaled)", in GUID format.

  3. Download the Install Big Sur/Monterey etc application from the App Store.

  4. Create a bootable recovery disk on the disk created in step 2 using the instructions here (https://support.apple.com/en-us/HT201372) on the new hard disk.

  5. Shutdown the guest macOS VM.

    From the VM settings -> Startup Disk -> Highlight the new hard disk from Step 1 and then select the Restart button.


    If using VMWare workstation/Player, access the firmware by spamming the R or F12 key and change the boot order so the disk created in step 2 is first.

    Then you will be on the installer, select your language then choose terminal and enter csrutil disable and will see the confirmation message and BOOM it is turned off and you can shed a few tears of joy and enjoy the ego. :)

  6. Restart and enter the firmware using the R or F12 key and change the boot order back to original settings.

If you are still having issues, I can try and make a video.

  • I can not get "enter the firmware using the R or F12 key" to work. Would it not be easier to hold down the option key and then select the Restart to firmware... button on the Startup Disk pane of Settings? Mar 11 at 20:31
  • Yes choose whatever method works for you to enter the bios…..restart to firmware or power on to firmware etc etc etc Mar 13 at 7:56

Lots of VERY complicated answers to this question, but I have a much easier way to do it.

First download a bootable ISO of Big Sur from the internet (there are a number of them on the Internet Archive, do a search). Then in the Virtual Machine Settings CD/DVD (SATA) Hardware settings, set it to be "Connected" and "Connected at power on", and point it to the ISO image you downloaded.

Then with your VM shut down, go to the menu: VM - Power - Power onto Firmware

Note: If you are using the free version of VMware Fusion Player, then “menu: VM - Power - Power onto Firmware” will not exist. Instead, goto the Startup Disk pane of Settings, hold down the option key, then select the “Restart to Firmware…” button.

Within the firmware, select "Enter Setup"

"Configure Boot Options"

"Change boot order"

then hit enter, and select EFI VMware Virtual SATA CDROM Drive (1.0) and then hit the plus sign to move it to the top.

"Commit changes and exit"

"Exit the Boot Maintenance Manager"

"Shut down the system"

Your VM then should boot into the Recovery environment, and you can disable or enable SIP with Terminal there.

And I've found if while you are in Recovery Mode, and you select the Apple menu "Startup Disk", and set it back to your regular boot image, that there is no need to go back into the the VM firmware settings to unset the DVD boot first option.

But I've found that the BEST thing to do is to leave the CDROM boot option set in the firmware, and leave the ISO in your VMware's folder ready to be easily accessed, and just check (or uncheck) the VM's CD/DVD "Connect at power on" setting whenever you want to boot into Recovery Mode (or not.)


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .