/* Class = "NSButtonCell"; title = "DEBUG_INFO in DEBUG, NOOPT"; ObjectID = "0hR-wG-mgt"; */ "0hR-wG-mgt.title" = "DEBUG_INFO in DEBUG, NOOPT"; /* Class = "NSButton"; ibShadowedToolTip = "Type: plist boolean\nFailsafe: false\nDescription: Enable VirtualSMC-compatible authenticated restart.\nAuthenticated restart is a way to reboot FileVault 2 enabled macOS without entering the password. To perform authenticated restart one can use a dedicated terminal command: sudo fdesetup authrestart. It is also used when installing operating system updates.\nVirtualSMC performs authenticated restart by saving disk encryption key split in NVRAM and RTC, which despite being removed as soon as OpenCore starts, may be considered a security risk and thus is optional."; ObjectID = "0sy-D3-AKk"; */ "0sy-D3-AKk.ibShadowedToolTip" = "Type: plist boolean\nFailsafe: false\nDescription: Enable VirtualSMC-compatible authenticated restart.\nAuthenticated restart is a way to reboot FileVault 2 enabled macOS without entering the password. To perform authenticated restart one can use a dedicated terminal command: sudo fdesetup authrestart. It is also used when installing operating system updates.\nVirtualSMC performs authenticated restart by saving disk encryption key split in NVRAM and RTC, which despite being removed as soon as OpenCore starts, may be considered a security risk and thus is optional."; /* Class = "NSTableColumn"; headerCell.title = "Comment"; ObjectID = "1NZ-HO-WUF"; */ "1NZ-HO-WUF.headerCell.title" = "Comment"; /* Class = "NSTableColumn"; headerCell.title = "Auxiliary"; ObjectID = "1fY-U6-4KQ"; */ "1fY-U6-4KQ.headerCell.title" = "Auxiliary"; /* Class = "NSTableColumn"; headerCell.title = "Name"; ObjectID = "22Z-wl-E30"; */ "22Z-wl-E30.headerCell.title" = "Name"; /* Class = "NSButtonCell"; title = "Enable logging to Data Hub"; ObjectID = "2Qh-mc-sJw"; */ "2Qh-mc-sJw.title" = "Enable logging to Data Hub"; /* Class = "NSTextField"; ibShadowedToolTip = "Type: plist integer\nDefault value: 0\nDescription: A bitmask (sum) of enabled logging targets. By default all the logging output is hidden, so this option is required to be set when debugging is necessary.\nThe following logging targets are supported:\n• 0x01 — Enable logging, otherwise all log is discarded.\n• 0x02 — Enable basic console (onscreen) logging.\n• 0x04 — Enable logging to Data Hub.\n• 0x08 — Enable serial port logging.\n• 0x10 — Enable UEFI variable logging.\n• 0x20 — Enable non-volatile UEFI variable logging.\n• 0x40 — Enable logging to file.\nConsole logging prints less than all the other variants. Depending on the build type (RELEASE, DEBUG, or NOOPT) different amount of logging may be read (from least to most)."; ObjectID = "2Vb-s2-Ejp"; */ "2Vb-s2-Ejp.ibShadowedToolTip" = "Type: plist integer\nDefault value: 0\nDescription: A bitmask (sum) of enabled logging targets. By default all the logging output is hidden, so this option is required to be set when debugging is necessary.\nThe following logging targets are supported:\n• 0x01 — Enable logging, otherwise all log is discarded.\n• 0x02 — Enable basic console (onscreen) logging.\n• 0x04 — Enable logging to Data Hub.\n• 0x08 — Enable serial port logging.\n• 0x10 — Enable UEFI variable logging.\n• 0x20 — Enable non-volatile UEFI variable logging.\n• 0x40 — Enable logging to file.\nConsole logging prints less than all the other variants. Depending on the build type (RELEASE, DEBUG, or NOOPT) different amount of logging may be read (from least to most)."; /* Class = "NSButtonCell"; title = "Unselect All"; ObjectID = "2dj-hB-QBF"; */ "2dj-hB-QBF.title" = "Unselect All"; /* Class = "NSButton"; ibShadowedToolTip = "Type: plist boolean\nFailsafe: false\nDescription: Save macOS kernel panic to OpenCore root partition.\nThe file is saved as panic-YYYY-MM-DD-HHMMSS.txt. It is strongly recommended to have keepsyms=1 boot argument to see debug symbols in the panic log. In case it was not present kpdescribe.sh utility (bundled with OpenCore) may be used to partially recover the stacktrace.\nDevelopment and debug kernels produce more helpful kernel panics. Consider downloading and installing\nKernelDebugKit from developer.apple.com when debugging a problem. To activate a development kernel you will need to add a kcsuffix=development boot argument. Use uname -a command to ensure that your current loaded kernel is a development (or a debug) kernel.\nIn case OpenCore kernel panic saving mechanism was not used, kernel panics may still be found in /Library/Logs/Diagnostic directory. Starting with macOS Catalina kernel panics are stored in JSON format, so they need to be preprocessedbefore passing to kpdescribe.sh: \ncat Kernel.panic | grep macOSProcessedStackshotData | python -c 'import json,sys;print(json.load(sys.stdin)[\"macOSPanicString\"])'"; ObjectID = "2lk-2r-hIW"; */ "2lk-2r-hIW.ibShadowedToolTip" = "Type: plist boolean\nFailsafe: false\nDescription: Save macOS kernel panic to OpenCore root partition.\nThe file is saved as panic-YYYY-MM-DD-HHMMSS.txt. It is strongly recommended to have keepsyms=1 boot argument to see debug symbols in the panic log. In case it was not present kpdescribe.sh utility (bundled with OpenCore) may be used to partially recover the stacktrace.\nDevelopment and debug kernels produce more helpful kernel panics. Consider downloading and installing\nKernelDebugKit from developer.apple.com when debugging a problem. To activate a development kernel you will need to add a kcsuffix=development boot argument. Use uname -a command to ensure that your current loaded kernel is a development (or a debug) kernel.\nIn case OpenCore kernel panic saving mechanism was not used, kernel panics may still be found in /Library/Logs/Diagnostic directory. Starting with macOS Catalina kernel panics are stored in JSON format, so they need to be preprocessedbefore passing to kpdescribe.sh: \ncat Kernel.panic | grep macOSProcessedStackshotData | python -c 'import json,sys;print(json.load(sys.stdin)[\"macOSPanicString\"])'"; /* Class = "NSButtonCell"; title = "Select All"; ObjectID = "3K9-EU-jse"; */ "3K9-EU-jse.title" = "Select All"; /* Class = "NSTabViewItem"; label = "Boot"; ObjectID = "3fm-9G-OpP"; */ "3fm-9G-OpP.label" = "Boot"; /* Class = "NSTabViewItem"; label = "Security"; ObjectID = "3fm-Nz-fHj"; */ "3fm-Nz-fHj.label" = "Security"; /* Class = "NSPopUpButton"; ibShadowedToolTip = "Type: plist string\nFailsafe: Builtin\nDescription: Choose boot picker used for boot management.\nPicker describes underlying boot management with an optional user interface responsible for handling boot\noptions. The following values are supported:\n• Builtin — boot management is handled by OpenCore, a simple text only user interface is used.\n• External — an external boot management protocol is used if available. Otherwise Builtin mode is used.\n• Apple — Apple boot management is used if available. Otherwise Builtin mode is used.\n\nUpon success External mode will entirely disable all boot management in OpenCore except policy enforcement. See OpenCanopy plugin for an example of a custom user interface.\nOpenCore built-in boot picker contains a set of actions chosen during the boot process. The list of supported actions is similar to Apple BDS and in general can be accessed by holding action hotkeys during boot process. Currently the following actions are considered:\n• Default — this is the default option, and it lets OpenCore built-in boot picker to loads the default boot option as specified in Startup Disk preference pane.\n• ShowPicker — this option forces picker to show. Normally it can be achieved by holding OPT key during boot. Setting ShowPicker to true will make ShowPicker the default option.\n• ResetNvram — this option performs select UEFI variable erase and is normally achieved by holding CMD+OPT+P+R key combination during boot. Another way to erase UEFI variables is to choose Reset NVRAM in the picker. This option requires AllowNvramReset to be set to true.\n• BootApple — this options performs booting to the first found Apple operating system unless the default chosen operating system is already made by Apple. Hold X key to choose this option.\n• BootAppleRecovery — this option performs booting to Apple operating system recovery. Either the one related to the default chosen operating system, or first found in case default chosen operating system is not made by Apple or has no recovery. Hold CMD+R key combination to choose this option.\nNote 1: Activated KeySupport, OpenUsbKbDxe, or similar driver is required for key handling to work. On many firmwares it is not possible to get all the keys function.\nNote 2: In addition to OPT OpenCore supports Escape key to display picker when ShowPicker is disabled. This key exists for Apple picker mode and for firmwares with PS/2 keyboards that fail to report held OPT key and require continual presses of Escape key to enter the boot menu.\nNote 3: On Macs with problematic GOP it may be difficult to access Apple BootPicker. To workaround this problem even without loading OpenCore BootKicker utility can be blessed."; ObjectID = "5Or-M0-hZS"; */ "5Or-M0-hZS.ibShadowedToolTip" = "Type: plist string\nFailsafe: Builtin\nDescription: Choose boot picker used for boot management.\nPicker describes underlying boot management with an optional user interface responsible for handling boot\noptions. The following values are supported:\n• Builtin — boot management is handled by OpenCore, a simple text only user interface is used.\n• External — an external boot management protocol is used if available. Otherwise Builtin mode is used.\n• Apple — Apple boot management is used if available. Otherwise Builtin mode is used.\n\nUpon success External mode will entirely disable all boot management in OpenCore except policy enforcement. See OpenCanopy plugin for an example of a custom user interface.\nOpenCore built-in boot picker contains a set of actions chosen during the boot process. The list of supported actions is similar to Apple BDS and in general can be accessed by holding action hotkeys during boot process. Currently the following actions are considered:\n• Default — this is the default option, and it lets OpenCore built-in boot picker to loads the default boot option as specified in Startup Disk preference pane.\n• ShowPicker — this option forces picker to show. Normally it can be achieved by holding OPT key during boot. Setting ShowPicker to true will make ShowPicker the default option.\n• ResetNvram — this option performs select UEFI variable erase and is normally achieved by holding CMD+OPT+P+R key combination during boot. Another way to erase UEFI variables is to choose Reset NVRAM in the picker. This option requires AllowNvramReset to be set to true.\n• BootApple — this options performs booting to the first found Apple operating system unless the default chosen operating system is already made by Apple. Hold X key to choose this option.\n• BootAppleRecovery — this option performs booting to Apple operating system recovery. Either the one related to the default chosen operating system, or first found in case default chosen operating system is not made by Apple or has no recovery. Hold CMD+R key combination to choose this option.\nNote 1: Activated KeySupport, OpenUsbKbDxe, or similar driver is required for key handling to work. On many firmwares it is not possible to get all the keys function.\nNote 2: In addition to OPT OpenCore supports Escape key to display picker when ShowPicker is disabled. This key exists for Apple picker mode and for firmwares with PS/2 keyboards that fail to report held OPT key and require continual presses of Escape key to enter the boot menu.\nNote 3: On Macs with problematic GOP it may be difficult to access Apple BootPicker. To workaround this problem even without loading OpenCore BootKicker utility can be blessed."; /* Class = "NSButtonCell"; title = "Enable UEFI variable logging"; ObjectID = "6U3-np-fQe"; */ "6U3-np-fQe.title" = "Enable UEFI variable logging"; /* Class = "NSTextFieldCell"; title = "Timeout"; ObjectID = "6hf-UH-eBA"; */ "6hf-UH-eBA.title" = "Timeout"; /* Class = "NSButtonCell"; title = "HideAuxiliary"; ObjectID = "7BP-eo-vIZ"; */ "7BP-eo-vIZ.title" = "HideAuxiliary"; /* Class = "NSButtonCell"; title = "Expose OpenCore version in boot picker menu title."; ObjectID = "7NC-lm-XEM"; */ "7NC-lm-XEM.title" = "Expose OpenCore version in boot picker menu title."; /* Class = "NSTableView"; ibShadowedToolTip = "1. Arguments\nType: plist string\nFailsafe: Empty string\nDescription: Arbitrary ASCII string used as boot arguments (load options) of the specified entry.\n2. Auxiliary\nType: plist boolean\nFailsafe: false\nDescription: This entry will not be listed by default when HideAuxiliary is set to true.\n3. Comment\nType: plist string\nFailsafe: Empty string\nDescription: Arbitrary ASCII string used to provide human readable reference for the entry. It is implementation defined whether this value is used.\n4. Enabled\nType: plist boolean\nFailsafe: false\nDescription: This entry will not be listed unless set to true.\n5. Name\nType: plist string\nFailsafe: Empty string\nDescription: Human readable entry name displayed in boot picker.\n6. Path\nType: plist string\nFailsafe: Empty string\nDescription: Entry location depending on entry type.\n• Entries specify external boot options, and therefore take device paths in Path key. These values are not checked, thus be extremely careful. Example: PciRoot(0x0)/Pci(0x1,0x1)/.../\\EFI\\COOL.EFI\n• Tools specify internal boot options, which are part of bootloader vault, and therefore take file paths relative to OC/Tools directory. Example: OpenShell.efi."; ObjectID = "8Gl-6A-OsL"; */ "8Gl-6A-OsL.ibShadowedToolTip" = "1. Arguments\nType: plist string\nFailsafe: Empty string\nDescription: Arbitrary ASCII string used as boot arguments (load options) of the specified entry.\n2. Auxiliary\nType: plist boolean\nFailsafe: false\nDescription: This entry will not be listed by default when HideAuxiliary is set to true.\n3. Comment\nType: plist string\nFailsafe: Empty string\nDescription: Arbitrary ASCII string used to provide human readable reference for the entry. It is implementation defined whether this value is used.\n4. Enabled\nType: plist boolean\nFailsafe: false\nDescription: This entry will not be listed unless set to true.\n5. Name\nType: plist string\nFailsafe: Empty string\nDescription: Human readable entry name displayed in boot picker.\n6. Path\nType: plist string\nFailsafe: Empty string\nDescription: Entry location depending on entry type.\n• Entries specify external boot options, and therefore take device paths in Path key. These values are not checked, thus be extremely careful. Example: PciRoot(0x0)/Pci(0x1,0x1)/.../\\EFI\\COOL.EFI\n• Tools specify internal boot options, which are part of bootloader vault, and therefore take file paths relative to OC/Tools directory. Example: OpenShell.efi."; /* Class = "NSButtonCell"; title = "Disable WatchDog"; ObjectID = "9LG-wP-7Np"; */ "9LG-wP-7Np.title" = "Disable WatchDog"; /* Class = "NSButtonCell"; title = "DEBUG_WARN in DEBUG, NOOPT, RELEASE"; ObjectID = "AEq-Xa-8FR"; */ "AEq-Xa-8FR.title" = "DEBUG_WARN in DEBUG, NOOPT, RELEASE"; /* Class = "NSButtonCell"; title = "Select All"; ObjectID = "Ai7-te-FXf"; */ "Ai7-te-FXf.title" = "Select All"; /* Class = "NSTextFieldCell"; title = "Picker Mode"; ObjectID = "BYc-kG-loi"; */ "BYc-kG-loi.title" = "Picker Mode"; /* Class = "NSButtonCell"; title = "Expose OpenCore version as an UEFI variable."; ObjectID = "Bcn-4Z-d2d"; */ "Bcn-4Z-d2d.title" = "Expose OpenCore version as an UEFI variable."; /* Class = "NSButtonCell"; title = "Browse"; ObjectID = "Bpe-6y-ybA"; */ "Bpe-6y-ybA.title" = "Browse"; /* Class = "NSTextFieldCell"; title = "Expose Sensitive Data"; ObjectID = "DAS-KM-gwG"; */ "DAS-KM-gwG.title" = "Expose Sensitive Data"; /* Class = "NSButtonCell"; title = "Enable non-volatile UEFI variable logging"; ObjectID = "Da8-bR-9wd"; */ "Da8-bR-9wd.title" = "Enable non-volatile UEFI variable logging"; /* Class = "NSTableView"; ibShadowedToolTip = "Type: plist array\nDescription: Add custom scanning paths through bless model.\nDesigned to be filled with plist string entries containing absolute UEFI paths to customised bootloaders, for example, \\EFI\\Microsoft\\bootmgfw.efi for Microsoft bootloader. This allows unusual boot paths to be automaticlly discovered by the boot picker. Designwise they are equivalent to predefined blessed path, such as \\System\\Library\\CoreServices\\boot.efi, but unlike predefined bless paths they have highest priority."; ObjectID = "E7L-MW-EuK"; */ "E7L-MW-EuK.ibShadowedToolTip" = "Type: plist array\nDescription: Add custom scanning paths through bless model.\nDesigned to be filled with plist string entries containing absolute UEFI paths to customised bootloaders, for example, \\EFI\\Microsoft\\bootmgfw.efi for Microsoft bootloader. This allows unusual boot paths to be automaticlly discovered by the boot picker. Designwise they are equivalent to predefined blessed path, such as \\System\\Library\\CoreServices\\boot.efi, but unlike predefined bless paths they have highest priority."; /* Class = "NSButton"; ibShadowedToolTip = "Type: plist boolean \nFailsafe: false \nDescription: Ignore boot options trying to update Apple peripheral firmware (e.g. MultiUpdater.efi)."; ObjectID = "EQZ-0e-EuC"; */ "EQZ-0e-EuC.ibShadowedToolTip" = "Type: plist boolean \nFailsafe: false \nDescription: Ignore boot options trying to update Apple peripheral firmware (e.g. MultiUpdater.efi)."; /* Class = "NSButtonCell"; title = "OC_SCAN_ALLOW_FS_ESP"; ObjectID = "Edm-Vw-KuX"; */ "Edm-Vw-KuX.title" = "OC_SCAN_ALLOW_FS_ESP"; /* Class = "NSTextFieldCell"; title = "Display Delay"; ObjectID = "FHv-7q-Wq3"; */ "FHv-7q-Wq3.title" = "Display Delay"; /* Class = "NSButtonCell"; title = "Select All"; ObjectID = "Gaf-gn-k6J"; */ "Gaf-gn-k6J.title" = "Select All"; /* Class = "NSButtonCell"; title = "OC_SCAN_ALLOW_FS_EXT"; ObjectID = "H6a-QA-xQu"; */ "H6a-QA-xQu.title" = "OC_SCAN_ALLOW_FS_EXT"; /* Class = "NSButtonCell"; title = "Enable serial port logging"; ObjectID = "HjZ-gH-Q0b"; */ "HjZ-gH-Q0b.title" = "Enable serial port logging"; /* Class = "NSButtonCell"; title = "AllowNvramReset"; ObjectID = "Jpe-QB-x2r"; */ "Jpe-QB-x2r.title" = "AllowNvramReset"; /* Class = "NSButtonCell"; title = "Unselect All"; ObjectID = "KRE-fs-cVq"; */ "KRE-fs-cVq.title" = "Unselect All"; /* Class = "NSButtonCell"; title = "Provides custom rendered titles for boot entries"; ObjectID = "L3h-6q-xRi"; */ "L3h-6q-xRi.title" = "Provides custom rendered titles for boot entries"; /* Class = "NSButton"; ibShadowedToolTip = "Type: plist boolean\nFailsafe: false\nDescription: Select firmwares may not succeed in quickly booting the operating system, especially in debug mode, which results in watch dog timer aborting the process. This option turns off watch dog timer."; ObjectID = "LCd-qL-7KC"; */ "LCd-qL-7KC.ibShadowedToolTip" = "Type: plist boolean\nFailsafe: false\nDescription: Select firmwares may not succeed in quickly booting the operating system, especially in debug mode, which results in watch dog timer aborting the process. This option turns off watch dog timer."; /* Class = "NSButtonCell"; title = "Changes used icon set to an alternate one if it is supported"; ObjectID = "NFd-Yp-DAy"; */ "NFd-Yp-DAy.title" = "Changes used icon set to an alternate one if it is supported"; /* Class = "NSTableColumn"; headerCell.title = "Enabled"; ObjectID = "NXw-uw-Jsu"; */ "NXw-uw-Jsu.headerCell.title" = "Enabled"; /* Class = "NSTextFieldCell"; title = "BootProtect"; ObjectID = "OeD-Mz-a2a"; */ "OeD-Mz-a2a.title" = "BootProtect"; /* Class = "NSButton"; ibShadowedToolTip = "Type: plist boolean\nFailsafe: false\nDescription: Enable screen reader by default in boot picker.\nFor macOS bootloader screen reader preference is set in preferences.efires archive in isVOEnabled.int32 file and is controlled by the operating system. For OpenCore screen reader support this option is an independent equivalent. Toggling screen reader support in both OpenCore boot picker and macOS bootloader FileVault 2 login window can also be done with Command + F5 key combination.\nNote: screen reader requires working audio support, see UEFI Audio Properties section for more details."; ObjectID = "PDS-bo-Qx8"; */ "PDS-bo-Qx8.ibShadowedToolTip" = "Type: plist boolean\nFailsafe: false\nDescription: Enable screen reader by default in boot picker.\nFor macOS bootloader screen reader preference is set in preferences.efires archive in isVOEnabled.int32 file and is controlled by the operating system. For OpenCore screen reader support this option is an independent equivalent. Toggling screen reader support in both OpenCore boot picker and macOS bootloader FileVault 2 login window can also be done with Command + F5 key combination.\nNote: screen reader requires working audio support, see UEFI Audio Properties section for more details."; /* Class = "NSButtonCell"; title = "Unselect All"; ObjectID = "PDr-JO-EKf"; */ "PDr-JO-EKf.title" = "Unselect All"; /* Class = "NSTextFieldCell"; title = "ConsoleAttributes"; ObjectID = "PIX-Ia-ajs"; */ "PIX-Ia-ajs.title" = "ConsoleAttributes"; /* Class = "NSButtonCell"; title = "Browse"; ObjectID = "Pkl-Zl-stw"; */ "Pkl-Zl-stw.title" = "Browse"; /* Class = "NSTextField"; ibShadowedToolTip = "Type: plist integer\nDefault value: 0\nDescription: Delay in microseconds performed after every printed line visible onscreen (i.e. console)."; ObjectID = "PwU-cB-LIO"; */ "PwU-cB-LIO.ibShadowedToolTip" = "Type: plist integer\nDefault value: 0\nDescription: Delay in microseconds performed after every printed line visible onscreen (i.e. console)."; /* Class = "NSTextField"; ibShadowedToolTip = "TakeoffDelay \nType: plist integer, 32 bit \nFailsafe: 0\nDescription: Delay in microseconds performed before handling picker startup and action hotkeys. \nIntroducing a delay may give extra time to hold the right action hotkey sequence to e.g. boot to recovery mode. On some platforms setting this option to at least 5000-10000 microseconds may be necessary to access action hotkeys at all due to the nature of the keyboard driver."; ObjectID = "QGG-If-K71"; */ "QGG-If-K71.ibShadowedToolTip" = "TakeoffDelay \nType: plist integer, 32 bit \nFailsafe: 0\nDescription: Delay in microseconds performed before handling picker startup and action hotkeys. \nIntroducing a delay may give extra time to hold the right action hotkey sequence to e.g. boot to recovery mode. On some platforms setting this option to at least 5000-10000 microseconds may be necessary to access action hotkeys at all due to the nature of the keyboard driver."; /* Class = "NSPopUpButton"; ibShadowedToolTip = "Type: plist string\nFailsafe: Secure\nDescription: Enables vaulting mechanism in OpenCore.\nValid values:\n• Optional — require nothing, no vault is enforced, insecure.\n• Basic — require vault.plist file present in OC directory. This provides basic filesystem integrity verification and may protect from unintentional filesystem corruption.\n• Secure — require vault.sig signature file for vault.plist in OC directory. This includes Basic integrity checking but also attempts to build a trusted bootchain.\nvault.plist file should contain SHA-256 hashes for all files used by OpenCore. Presence of this file is highly recommended to ensure that unintentional file modifications (including filesystem corruption) do not happen unnoticed. To create this file automatically use create_vault.sh script. Regardless of the underlying filesystem, path name and case must match between config.plist and vault.plist.\nvault.sig file should contain a raw 256 byte RSA-2048 signature from SHA-256 hash of vault.plist. The signature is verified against the public key embedded into OpenCore.efi. To embed the public key you should do either of the following:\n• Provide public key during the OpenCore.efi compilation in OpenCoreVault.c file.\n• Binary patch OpenCore.efi replacing zeroes with the public key between =BEGIN OC VAULT= and ==END OC VAULT== ASCII markers.\nRSA public key 520 byte format description can be found in Chromium OS documentation. To convert public key from X.509 certificate or from PEM file use RsaTool.\n\nThe complete set of commands to:\n• Create vault.plist.\n• Create a new RSA key (always do this to avoid loading old configuration).\n• Embed RSA key into OpenCore.efi.\n• Create vault.sig.\n\nCan look as follows:\ncd /Volumes/EFI/EFI/OC/path/to/create_vault.sh .\n/path/to/RsaTool -sign vault.plist vault.sig vault.pub\noff=$(($(strings -a -t d OpenCore.efi | grep \"=BEGIN OC VAULT=\" | cut -f1 -d' ')+16))\ndd of=OpenCore.efi if=vault.pub bs=1 seek=$off count=528 conv=notrunc\nrm vault.pub\n\nNote 1: While it may appear obvious, but you have to use an external method to verify OpenCore.efi and BOOTx64.efi for secure boot path. For this you are recommended to at least enable UEFI SecureBoot with a custom certificate, and sign OpenCore.efi and BOOTx64.efi with your custom key. More details on customising secure boot on modern firmwares can be found in Taming UEFI SecureBoot paper (in Russian).\nNote 2: vault.plist and vault.sig are used regardless of this option when vault.plist is present or public key is embedded into OpenCore.efi. Setting this option will only ensure configuration sanity, and abort the boot process otherwise."; ObjectID = "QZk-2b-TCx"; */ "QZk-2b-TCx.ibShadowedToolTip" = "Type: plist string\nFailsafe: Secure\nDescription: Enables vaulting mechanism in OpenCore.\nValid values:\n• Optional — require nothing, no vault is enforced, insecure.\n• Basic — require vault.plist file present in OC directory. This provides basic filesystem integrity verification and may protect from unintentional filesystem corruption.\n• Secure — require vault.sig signature file for vault.plist in OC directory. This includes Basic integrity checking but also attempts to build a trusted bootchain.\nvault.plist file should contain SHA-256 hashes for all files used by OpenCore. Presence of this file is highly recommended to ensure that unintentional file modifications (including filesystem corruption) do not happen unnoticed. To create this file automatically use create_vault.sh script. Regardless of the underlying filesystem, path name and case must match between config.plist and vault.plist.\nvault.sig file should contain a raw 256 byte RSA-2048 signature from SHA-256 hash of vault.plist. The signature is verified against the public key embedded into OpenCore.efi. To embed the public key you should do either of the following:\n• Provide public key during the OpenCore.efi compilation in OpenCoreVault.c file.\n• Binary patch OpenCore.efi replacing zeroes with the public key between =BEGIN OC VAULT= and ==END OC VAULT== ASCII markers.\nRSA public key 520 byte format description can be found in Chromium OS documentation. To convert public key from X.509 certificate or from PEM file use RsaTool.\n\nThe complete set of commands to:\n• Create vault.plist.\n• Create a new RSA key (always do this to avoid loading old configuration).\n• Embed RSA key into OpenCore.efi.\n• Create vault.sig.\n\nCan look as follows:\ncd /Volumes/EFI/EFI/OC/path/to/create_vault.sh .\n/path/to/RsaTool -sign vault.plist vault.sig vault.pub\noff=$(($(strings -a -t d OpenCore.efi | grep \"=BEGIN OC VAULT=\" | cut -f1 -d' ')+16))\ndd of=OpenCore.efi if=vault.pub bs=1 seek=$off count=528 conv=notrunc\nrm vault.pub\n\nNote 1: While it may appear obvious, but you have to use an external method to verify OpenCore.efi and BOOTx64.efi for secure boot path. For this you are recommended to at least enable UEFI SecureBoot with a custom certificate, and sign OpenCore.efi and BOOTx64.efi with your custom key. More details on customising secure boot on modern firmwares can be found in Taming UEFI SecureBoot paper (in Russian).\nNote 2: vault.plist and vault.sig are used regardless of this option when vault.plist is present or public key is embedded into OpenCore.efi. Setting this option will only ensure configuration sanity, and abort the boot process otherwise."; /* Class = "NSTextField"; ibShadowedToolTip = "Type: plist integer, 64 bit\nDefault value: 0x80000000 (DEBUG_ERROR)\nDescription: EDK II debug level bitmask (sum) causing CPU to halt (stop execution) after obtaining a message of HaltLevel. Possible values match DisplayLevel values."; ObjectID = "QbL-ID-H0a"; */ "QbL-ID-H0a.ibShadowedToolTip" = "Type: plist integer, 64 bit\nDefault value: 0x80000000 (DEBUG_ERROR)\nDescription: EDK II debug level bitmask (sum) causing CPU to halt (stop execution) after obtaining a message of HaltLevel. Possible values match DisplayLevel values."; /* Class = "NSButtonCell"; title = "BlacklistAppleUpdate"; ObjectID = "RvC-iy-QL7"; */ "RvC-iy-QL7.title" = "BlacklistAppleUpdate"; /* Class = "NSButtonCell"; title = "Expose OEM information as a set of UEFI variables."; ObjectID = "SLo-CJ-cas"; */ "SLo-CJ-cas.title" = "Expose OEM information as a set of UEFI variables."; /* Class = "NSTableColumn"; headerCell.title = "Enabled"; ObjectID = "SPw-C4-qwL"; */ "SPw-C4-qwL.headerCell.title" = "Enabled"; /* Class = "NSButtonCell"; title = "Unselect All"; ObjectID = "SZj-0R-9Uu"; */ "SZj-0R-9Uu.title" = "Unselect All"; /* Class = "NSButtonCell"; title = "PollAppleHotKeys"; ObjectID = "TDv-Al-hb0"; */ "TDv-Al-hb0.title" = "PollAppleHotKeys"; /* Class = "NSTableColumn"; headerCell.title = "Arguments"; ObjectID = "ThF-JP-r8K"; */ "ThF-JP-r8K.headerCell.title" = "Arguments"; /* Class = "NSTextFieldCell"; title = "Hibernate Mode"; ObjectID = "TmR-t7-bmq"; */ "TmR-t7-bmq.title" = "Hibernate Mode"; /* Class = "NSButtonCell"; title = "Enable logging to file"; ObjectID = "Uz7-yL-WDQ"; */ "Uz7-yL-WDQ.title" = "Enable logging to file"; /* Class = "NSTextField"; ibShadowedToolTip = "Type: plist integer, 32 bit\nDefault value: 0xF0103\nDescription: Define operating system detection policy.\nThis value allows to prevent scanning (and booting) from untrusted source based on a bitmask (sum) of select flags. As it is not possible to reliably detect every file system or device type, this feature cannot be fully relied upon in open environments, and the additional measures are to be applied.\nThird party drivers may introduce additional security (and performance) measures following the provided scan policy. Scan policy is exposed in scan-policy variable of 4D1FDA02-38C7-4A6A-9CC6-4BCCA8B30102 GUID for UEFI Boot Services only.\n• 0x00000001 — OC_SCAN_FILE_SYSTEM_LOCK, restricts scanning to only known file systems defined as a part of this policy. File system drivers may not be aware of this policy, and to avoid mounting of undesired file systems it is best not to load its driver. This bit does not affect dmg mounting, which may have any file system. Known file systems are prefixed with OC_SCAN_ALLOW_FS_.\n• 0x00000002 — OC_SCAN_DEVICE_LOCK, restricts scanning to only known device types defined as a part of this policy. This is not always possible to detect protocol tunneling, so be aware that on some systems it may be possible for e.g. USB HDDs to be recognised as SATA. Cases like this must be reported. Known device types are prefixed with OC_SCAN_ALLOW_DEVICE_.\n• 0x00000100 — OC_SCAN_ALLOW_FS_APFS, allows scanning of APFS file system.\n• 0x00010000 — OC_SCAN_ALLOW_DEVICE_SATA, allow scanning SATA devices.\n• 0x00020000 — OC_SCAN_ALLOW_DEVICE_SASEX, allow scanning SAS and Mac NVMe devices.\n• 0x00040000 — OC_SCAN_ALLOW_DEVICE_SCSI, allow scanning SCSI devices.\n• 0x00080000 — OC_SCAN_ALLOW_DEVICE_NVME, allow scanning NVMe devices.\n• 0x00100000 — OC_SCAN_ALLOW_DEVICE_ATAPI, allow scanning CD/DVD devices.\n• 0x00200000 — OC_SCAN_ALLOW_DEVICE_USB, allow scanning USB devices.\n• 0x00400000 — OC_SCAN_ALLOW_DEVICE_FIREWIRE, allow scanning FireWire devices.\n• 0x00800000 — OC_SCAN_ALLOW_DEVICE_SDCARD, allow scanning card reader devices.\nNote: Given the above description, 0xF0103 value is expected to allow scanning of SATA, SAS, SCSI, and NVMe devices with APFS file system, and prevent scanning of any devices with HFS or FAT32 file systems in addition to not scanning APFS file systems on USB, CD, USB, and FireWire drives. The combination reads as:\n• OC_SCAN_FILE_SYSTEM_LOCK • OC_SCAN_DEVICE_LOCK\n• OC_SCAN_ALLOW_FS_APFS\n• OC_SCAN_ALLOW_DEVICE_SATA\n• OC_SCAN_ALLOW_DEVICE_SASEX\n• OC_SCAN_ALLOW_DEVICE_SCSI • OC_SCAN_ALLOW_DEVICE_NVME"; ObjectID = "VQF-Ne-GWu"; */ "VQF-Ne-GWu.ibShadowedToolTip" = "Type: plist integer, 32 bit\nDefault value: 0xF0103\nDescription: Define operating system detection policy.\nThis value allows to prevent scanning (and booting) from untrusted source based on a bitmask (sum) of select flags. As it is not possible to reliably detect every file system or device type, this feature cannot be fully relied upon in open environments, and the additional measures are to be applied.\nThird party drivers may introduce additional security (and performance) measures following the provided scan policy. Scan policy is exposed in scan-policy variable of 4D1FDA02-38C7-4A6A-9CC6-4BCCA8B30102 GUID for UEFI Boot Services only.\n• 0x00000001 — OC_SCAN_FILE_SYSTEM_LOCK, restricts scanning to only known file systems defined as a part of this policy. File system drivers may not be aware of this policy, and to avoid mounting of undesired file systems it is best not to load its driver. This bit does not affect dmg mounting, which may have any file system. Known file systems are prefixed with OC_SCAN_ALLOW_FS_.\n• 0x00000002 — OC_SCAN_DEVICE_LOCK, restricts scanning to only known device types defined as a part of this policy. This is not always possible to detect protocol tunneling, so be aware that on some systems it may be possible for e.g. USB HDDs to be recognised as SATA. Cases like this must be reported. Known device types are prefixed with OC_SCAN_ALLOW_DEVICE_.\n• 0x00000100 — OC_SCAN_ALLOW_FS_APFS, allows scanning of APFS file system.\n• 0x00010000 — OC_SCAN_ALLOW_DEVICE_SATA, allow scanning SATA devices.\n• 0x00020000 — OC_SCAN_ALLOW_DEVICE_SASEX, allow scanning SAS and Mac NVMe devices.\n• 0x00040000 — OC_SCAN_ALLOW_DEVICE_SCSI, allow scanning SCSI devices.\n• 0x00080000 — OC_SCAN_ALLOW_DEVICE_NVME, allow scanning NVMe devices.\n• 0x00100000 — OC_SCAN_ALLOW_DEVICE_ATAPI, allow scanning CD/DVD devices.\n• 0x00200000 — OC_SCAN_ALLOW_DEVICE_USB, allow scanning USB devices.\n• 0x00400000 — OC_SCAN_ALLOW_DEVICE_FIREWIRE, allow scanning FireWire devices.\n• 0x00800000 — OC_SCAN_ALLOW_DEVICE_SDCARD, allow scanning card reader devices.\nNote: Given the above description, 0xF0103 value is expected to allow scanning of SATA, SAS, SCSI, and NVMe devices with APFS file system, and prevent scanning of any devices with HFS or FAT32 file systems in addition to not scanning APFS file systems on USB, CD, USB, and FireWire drives. The combination reads as:\n• OC_SCAN_FILE_SYSTEM_LOCK • OC_SCAN_DEVICE_LOCK\n• OC_SCAN_ALLOW_FS_APFS\n• OC_SCAN_ALLOW_DEVICE_SATA\n• OC_SCAN_ALLOW_DEVICE_SASEX\n• OC_SCAN_ALLOW_DEVICE_SCSI • OC_SCAN_ALLOW_DEVICE_NVME"; /* Class = "NSButtonCell"; title = "OC_SCAN_FILE_SYSTEM_LOCK"; ObjectID = "Wnm-4q-QJ3"; */ "Wnm-4q-QJ3.title" = "OC_SCAN_FILE_SYSTEM_LOCK"; /* Class = "NSButtonCell"; title = "OC_SCAN_ALLOW_FS_NTFS"; ObjectID = "WsC-yj-V3g"; */ "WsC-yj-V3g.title" = "OC_SCAN_ALLOW_FS_NTFS"; /* Class = "NSButtonCell"; title = "OC_SCAN_ALLOW_DEVICE_SCSI"; ObjectID = "X1h-DD-gjM"; */ "X1h-DD-gjM.title" = "OC_SCAN_ALLOW_DEVICE_SCSI"; /* Class = "NSTableColumn"; headerCell.title = "Name"; ObjectID = "XRf-Yz-PVv"; */ "XRf-Yz-PVv.headerCell.title" = "Name"; /* Class = "NSTableColumn"; headerCell.title = "Path*"; ObjectID = "XSQ-pS-WUn"; */ "XSQ-pS-WUn.headerCell.title" = "Path*"; /* Class = "NSButtonCell"; title = "Show Picker"; ObjectID = "YKi-Mp-w6e"; */ "YKi-Mp-w6e.title" = "Show Picker"; /* Class = "NSButtonCell"; title = "OC_SCAN_ALLOW_DEVICE_NVME"; ObjectID = "YQh-9A-q5Q"; */ "YQh-9A-q5Q.title" = "OC_SCAN_ALLOW_DEVICE_NVME"; /* Class = "NSTabViewItem"; label = "Debug"; ObjectID = "Yod-ne-FH8"; */ "Yod-ne-FH8.label" = "Debug"; /* Class = "NSButton"; ibShadowedToolTip = "Type: plist boolean\nFailsafe: false\nDescription: Show simple boot picker to allow boot entry selection."; ObjectID = "Yyf-Yd-yrP"; */ "Yyf-Yd-yrP.ibShadowedToolTip" = "Type: plist boolean\nFailsafe: false\nDescription: Show simple boot picker to allow boot entry selection."; /* Class = "NSButtonCell"; title = "Enable basic console (onscreen) logging"; ObjectID = "ZZP-5O-C0h"; */ "ZZP-5O-C0h.title" = "Enable basic console (onscreen) logging"; /* Class = "NSTextField"; ibShadowedToolTip = "Type: plist integer, 32 bit\nDefault value: 0\nDescription: Timeout in seconds in boot picker before automatic booting of the default boot entry. Use 0 to disable timer."; ObjectID = "Zxi-ww-dWk"; */ "Zxi-ww-dWk.ibShadowedToolTip" = "Type: plist integer, 32 bit\nDefault value: 0\nDescription: Timeout in seconds in boot picker before automatic booting of the default boot entry. Use 0 to disable timer."; /* Class = "NSButtonCell"; title = "OC_SCAN_ALLOW_DEVICE_SATA"; ObjectID = "aQY-Kx-ZCy"; */ "aQY-Kx-ZCy.title" = "OC_SCAN_ALLOW_DEVICE_SATA"; /* Class = "NSTextFieldCell"; title = "Scan Policy"; ObjectID = "aUx-rK-UTX"; */ "aUx-rK-UTX.title" = "Scan Policy"; /* Class = "NSButtonCell"; title = "Select All"; ObjectID = "b27-wQ-s5W"; */ "b27-wQ-s5W.title" = "Select All"; /* Class = "NSButtonCell"; title = "PickerAudioAssist"; ObjectID = "cN2-ao-nCB"; */ "cN2-ao-nCB.title" = "PickerAudioAssist"; /* Class = "NSTextFieldCell"; title = "Display Level"; ObjectID = "dam-Nc-xFX"; */ "dam-Nc-xFX.title" = "Display Level"; /* Class = "NSButtonCell"; title = "Provides predefined label images for boot entries without custom entries"; ObjectID = "dl8-kF-ipf"; */ "dl8-kF-ipf.title" = "Provides predefined label images for boot entries without custom entries"; /* Class = "NSButtonCell"; title = "OC_SCAN_ALLOW_DEVICE_USB"; ObjectID = "eFc-bE-Fl5"; */ "eFc-bE-Fl5.title" = "OC_SCAN_ALLOW_DEVICE_USB"; /* Class = "NSTableView"; ibShadowedToolTip = "1. Arguments\nType: plist string\nFailsafe: Empty string\nDescription: Arbitrary ASCII string used as boot arguments (load options) of the specified entry.\n2. Comment\nType: plist string\nFailsafe: Empty string\nDescription: Arbitrary ASCII string used to provide human readable reference for the entry. It is implementation defined whether this value is used.\n3. Auxiliary\nType: plist boolean\nFailsafe: false\nDescription: This entry will not be listed by default when HideAuxiliary is set to true.\n4. Enabled\nType: plist boolean\nFailsafe: false\nDescription: This tool will not be listed unless set to true.\n5. Name\nType: plist string\nFailsafe: Empty string\nDescription: Human readable tool name displayed in boot picker.\n6. Path\nType: plist string\nFailsafe: Empty string\nDescription: File path to select UEFI tool relative to OC/Tools directory."; ObjectID = "eH6-nm-MdQ"; */ "eH6-nm-MdQ.ibShadowedToolTip" = "1. Arguments\nType: plist string\nFailsafe: Empty string\nDescription: Arbitrary ASCII string used as boot arguments (load options) of the specified entry.\n2. Comment\nType: plist string\nFailsafe: Empty string\nDescription: Arbitrary ASCII string used to provide human readable reference for the entry. It is implementation defined whether this value is used.\n3. Auxiliary\nType: plist boolean\nFailsafe: false\nDescription: This entry will not be listed by default when HideAuxiliary is set to true.\n4. Enabled\nType: plist boolean\nFailsafe: false\nDescription: This tool will not be listed unless set to true.\n5. Name\nType: plist string\nFailsafe: Empty string\nDescription: Human readable tool name displayed in boot picker.\n6. Path\nType: plist string\nFailsafe: Empty string\nDescription: File path to select UEFI tool relative to OC/Tools directory."; /* Class = "NSTextFieldCell"; title = "Picker Attributes"; ObjectID = "eaZ-uU-2Tt"; */ "eaZ-uU-2Tt.title" = "Picker Attributes"; /* Class = "NSTextFieldCell"; title = "Vault"; ObjectID = "fN9-q5-dg3"; */ "fN9-q5-dg3.title" = "Vault"; /* Class = "NSButton"; ibShadowedToolTip = "Type: plist boolean\nFailsafe: false\nDescription: Enable boot.efi debug log saving to OpenCore log.\n\nNote: This option only applies to 10.15.4 and newer."; ObjectID = "fcn-ha-taM"; */ "fcn-ha-taM.ibShadowedToolTip" = "Type: plist boolean\nFailsafe: false\nDescription: Enable boot.efi debug log saving to OpenCore log.\n\nNote: This option only applies to 10.15.4 and newer."; /* Class = "NSTextField"; ibShadowedToolTip = "Type: plist integer\nFailsafe: 0\nDescription: Sets specific attributes for picker.\nBuiltin picker supports colour arguments as a sum of foreground and background colors according to UEFI specification. The value of black background and black foreground (0) is reserved. List of colour names:\n• 0x00 — EFI_BLACK\n• 0x01 — EFI_BLUE\n• 0x02 — EFI_GREEN\n• 0x03 — EFI_CYAN\n• 0x04 — EFI_RED\n• 0x05 — EFI_MAGENTA\n• 0x06 — EFI_BROWN\n• 0x07 — EFI_LIGHTGRAY\n• 0x08 — EFI_DARKGRAY\n• 0x09 — EFI_LIGHTBLUE\n• 0x0A — EFI_LIGHTGREEN\n• 0x0B — EFI_LIGHTCYAN\n• 0x0C — EFI_LIGHTRED\n• 0x0D — EFI_LIGHTMAGENTA \n• 0x0E — EFI_YELLOW\n• 0x0F — EFI_WHITE\n• 0x00 — EFI_BACKGROUND_BLACK\n• 0x10 — EFI_BACKGROUND_BLUE\n• 0x20 — EFI_BACKGROUND_GREEN\n• 0x30 — EFI_BACKGROUND_CYAN\n• 0x40 — EFI_BACKGROUND_RED\n• 0x50 — EFI_BACKGROUND_MAGENTA\n• 0x60 — EFI_BACKGROUND_BROWN\n• 0x70 — EFI_BACKGROUND_LIGHTGRAY\nNote: This option may not work well with System text renderer. Setting a background different from black could help testing proper GOP functioning."; ObjectID = "gD0-Iz-n35"; */ "gD0-Iz-n35.ibShadowedToolTip" = "Type: plist integer\nFailsafe: 0\nDescription: Sets specific attributes for picker.\nBuiltin picker supports colour arguments as a sum of foreground and background colors according to UEFI specification. The value of black background and black foreground (0) is reserved. List of colour names:\n• 0x00 — EFI_BLACK\n• 0x01 — EFI_BLUE\n• 0x02 — EFI_GREEN\n• 0x03 — EFI_CYAN\n• 0x04 — EFI_RED\n• 0x05 — EFI_MAGENTA\n• 0x06 — EFI_BROWN\n• 0x07 — EFI_LIGHTGRAY\n• 0x08 — EFI_DARKGRAY\n• 0x09 — EFI_LIGHTBLUE\n• 0x0A — EFI_LIGHTGREEN\n• 0x0B — EFI_LIGHTCYAN\n• 0x0C — EFI_LIGHTRED\n• 0x0D — EFI_LIGHTMAGENTA \n• 0x0E — EFI_YELLOW\n• 0x0F — EFI_WHITE\n• 0x00 — EFI_BACKGROUND_BLACK\n• 0x10 — EFI_BACKGROUND_BLUE\n• 0x20 — EFI_BACKGROUND_GREEN\n• 0x30 — EFI_BACKGROUND_CYAN\n• 0x40 — EFI_BACKGROUND_RED\n• 0x50 — EFI_BACKGROUND_MAGENTA\n• 0x60 — EFI_BACKGROUND_BROWN\n• 0x70 — EFI_BACKGROUND_LIGHTGRAY\nNote: This option may not work well with System text renderer. Setting a background different from black could help testing proper GOP functioning."; /* Class = "NSTextFieldCell"; title = "Target"; ObjectID = "hAm-Ha-Meb"; */ "hAm-Ha-Meb.title" = "Target"; /* Class = "NSTextField"; ibShadowedToolTip = "Type: plist integer\nFailsafe: 0\nDescription: Sets specific attributes for picker.\nDifferent pickers may be configured through\nthe attribute mask containing OpenCore-reserved (BIT0~BIT15) and OEM-specific (BIT16~BIT31) values.\nCurrent OpenCore values include:\n• 0x0001 — OC_ATTR_USE_VOLUME_ICON, provides custom icons for boot entries:\n\t– .VolumeIcon.icns file at Preboot root for APFS. \n\t– .VolumeIcon.icns file at volume root for other filesystems.\n\t– .icns file for Tools.  \nVolume icons can be set in Finder. \n• 0x0002 — OC_ATTR_USE_DISK_LABEL_FILE, provides custom rendered titles for boot entries: 
\t– .disk_label (.disk_label_2x) file near bootloader for all filesystems.
\t–