spctl -a -vv -t install，然后空格，拖拽你下载的kext到终端，回车
/usr/sbin/spctl kext-consent list
/usr/sbin/spctl kext-consent add 54GTJ2AU36
delete from kext_load_history_v3 where team_id='54GTJ2AU36';
delete from kext_policy where team_id='54GTJ2AU36';
rm -rf HoRNDIS.kext
SIP or more properly known as System Integrity Protection, is a security technology that attempts to prevent any malicious software and the end user from damaging the OS. First introduced with OS X El Capitan, SIP has grown over time to control more and more things in macOS, including limiting edits to restricted file locations and 3rd party kext loading with
kextload(OpenCore is unaffected as kexts are injected at boot). To resolve this, Apple has provided numerous configuration options in the NVRAM variable
csr-active-config which can either be set in the macOS recovery environment or with OpenCore’s NVRAM section(The latter will be discussed below).
- WARNING: Disabling SIP can break OS functionality such as software updates in macOS 11, Big Sur and newer. Please be careful to only disable specific SIP values instead of disabling SIP outright to avoid these issues.
CSR_ALLOW_APPLE_INTERNALare common options that can break OS updates for users
You can choose different values to enable or disable certain flags of SIP. Some useful tools to help you with these are CsrDecode (opens new window)and csrstat (opens new window). Common values are as follows (bytes are pre-hex swapped for you, and note that they go under NVRAM -> Add -> 7C436110-AB2A-4BBB-A880-FE41995C9F82 -> csr-active-config):
00000000– SIP completely enabled (0x0).
03000000– Disable kext signing (0x1) and filesystem protections (0x2).
FF030000– Disable all flags in macOS High Sierra (opens new window)(0x3ff).
FF070000– Disable all flags in macOS Mojave (opens new window)and in macOS Catalina (opens new window)(0x7ff) as Apple introduced a value for executable policy.
FF0F0000– Disable all flags in macOS Big Sur (0xfff) which has another new flag for authenticated root (opens new window).
Note: Disabling SIP with OpenCore is quite a bit different compared to Clover, specifically that NVRAM variables will not be overwritten unless explicitly told so under the
Delete section. So if you’ve already set SIP once either via OpenCore or in macOS, you must override the variable:
NVRAM -> Delete -> 7C436110-AB2A-4BBB-A880-FE41995C9F82 -> csr-active-config