How to Disable FileVault During a Fresh Installation (Clover & OpenCore)

[Max.1974]

Thanks to @Slice  @LockDown and  @luxinhaus for perfect patch for Clover

 

And @Luchina for Opencore video tutorial on Youtube.

 

This tutorial aims to disable FileVault during installation or updates using patch key in Clover and OpenCore through a kernel patch, simply by adding the following keys:

 

Clover

 

FilevaultDisabler.plist

 

 

 

 

Optionally its possible add this Drivers UEFI/Off from Clover V2 

 

 - AppleKeyFeeder.efi

 

 - HashServiceFix.efi

 

 

Approved by @Slice (many thanks my friend!)

 

 

 

https://github.com/CloverHackyColor/CloverBootloader/actions/runs/19600386416 

 

 

 

Opencore

 

 

FileVault-Disable Patch - Opencore - Hackintosh.plist.zip

 

 

The tests were performed using Clover 5164 (latest release), Opencore 1.0.6 and FileVault was not enabled during installation. 

 

If you need to enable it, you must remove or disable the patch in the config.plist.

 

Good Lucky 

 

 

 

Credits:  @Luchina 

 

https://youtu.be/9Wjvh--emWY

 

 

Edited November 22, 2025 by Max.1974

[LockDown]

there is REPLACE entry but no FIND entry🤔

im just curious my friend

[XanthraX]

My friend, can you post here the patch for OpenCore in property list format? Or a plain text format. I am not a programmer and I feel very confused in the different languages to present data. I am not sure if I made something wrong here:

[Max.1974]

Edited November 17, 2025 by Max.1974

[LockDown]

Thanks @Max.1974

I change comment 850c08686ac53d7b90a5ddab2224de96 to Filevault Disabler to be more significant

[XanthraX]

3 hours ago, Max.1974 said:

Hi @XanthraX, this patch is for Opencore. Use Xplist or Xcode to edit.  

 

 

 

 

FileVault-Disable Patch - Opencore - Hackintosh.plist.zip 1.32 kB · 8 downloads

 

Thank you my friend. I have used prefedit and it not supported this string "B800000000C3" as data. Now it worked with Xplist. 

 

Edited November 17, 2025 by XanthraX

[Henties]

@Max.1974Can confirm that your kernel patch for OC, to inhibit automatic activation by Tahoe of "filevault", when updating/upgrading,

works very well indeed.

 

Logging out of my Apple Account, prior to an update/upgrade, also works to achieve the same result, with the drawback that 

when an update/upgrade has been completed one must once again login to the various Apple Services, one wishes to use.

 

My perceived Apple longevity, in being able to use the latest Apple Intel Tahoe incarnation, has indeed been enhanced by your

simplified manner to prevent the automatic activation of "filevault", during an upgrade and or fresh installation of Tahoe.

 

Well done and thank you.

 

Greetings Henties

 

 

 

[Max.1974]

10 minutes ago, Henties said:

@Max.1974Can confirm that your kernel patch for OC, to inhibit automatic activation by Tahoe of "filevault", when updating/upgrading,

works very well indeed.

 

Logging out of my Apple Account, prior to an update/upgrade, also works to achieve the same result, with the drawback that 

when an update/upgrade has been completed one must once again login to the various Apple Services, one wishes to use.

 

My perceived Apple longevity, in being able to use the latest Apple Intel Tahoe incarnation, has indeed been enhanced by your

simplified manner to prevent the automatic activation of "filevault", during an upgrade and or fresh installation of Tahoe.

 

Well done and thank you.

 

Greetings Henties

 

 

 

Enjoy it my friend. Thank you 🙏🏻 

13 minutes ago, XanthraX said:

Thank you my friend. I have used prefedit and it not supported this string "B800000000C3" as data. Now it worked with Xplist. 

 

God bless you all 

 

[kgp]

Thanks @Max.1974 ! Awesome work and excellent news for all of us! 💯 

[deeveedee]

@Max.1974 This looks like the inverse of the _apfs_filefault_allowed patch used by Open Core Legacy Patcher - correct?

 

 

Difference:

Allow FV: <B801000000C3>
 
Disable FV: <B800000000C3>

 

[Max.1974]

5 hours ago, KGP-iMacPro said:

Thanks @Max.1974 ! Awesome work and excellent news for all of us! 💯 

Enjoy it my friend!!!  

Edited November 17, 2025 by Max.1974

[LockDown]

Clover patch will not work if FIND is empty

[LockDown]

Arch has no function in Clover. Base  in Clover is called Procedure. Identifier is Name in clover, and so on...So the pic for clover in post #1 will not work. Same goes for FIND, clover needs it for REPLACE

 

Edited November 18, 2025 by LockDown

[LockDown]

@Max.1974

check my Desktop1 signature.

I wouldnt be arguing if I didnt test it.

It is true that OpenCore is part of Clover. But the labels are not the same

[Avery B]

7.6.6 under the OC configuration pdf. If find is not specified, it replaces bytes directly at wherever the Base value is. In this case, it's overriding _apfs_filevault_allowed to always return false (or true in the OCLP case).
Should work with clover since it uses Opencore's paching iirc, but there maybe additional checks and/or restrictions I'm not aware of within Clover.

[LockDown]

18 minutes ago, Avery B said:

7.6.6 under the OC configuration pdf. If find is not specified, it replaces bytes directly at wherever the Base value is. In this case, it's overriding _apfs_filevault_allowed to always return false (or true in the OCLP case).

This is OC feature. Clover does not have that

 

 

18 minutes ago, Avery B said:

but there maybe additional checks and/or restrictions I'm not aware of within Clover.

This is true. (OC kernel/kext patching is different from Clover)

 

But nevertheless. We are good 😶

Nothing personal 

Edited November 19, 2025 by LockDown

[LockDown]

11 minutes ago, Max.1974 said:

@LockDown I’ll test it without mentioning the keys and reinstall it to show the results here, but I don’t have a capture card to record proof.

I’m not offended, mate. Its part of game  

 

This looks better now

Just fillup the Name (Identifier in OC) so it knows the target kext

Edited November 19, 2025 by LockDown

[Avery B]

https://github.com/CloverHackyColor/CloverBootloader/blob/c56331237d75867b164fab4eff045e13d38aa87c/rEFIt_UEFI/Settings/ConfigPlist/Config_KernelAndKextPatches.h#L44

Think theoretically if you remove this line, it should work with Clover. Seems to just be a parsing limitation with Clover. Then it would work the same as OC.

[LockDown]

3 minutes ago, Avery B said:

Think theoretically if you remove this line, it should work with Clover. 

That would be modding clover build that aint universal

Edited November 19, 2025 by LockDown

[LockDown]

@Max.1974

Of course it will be disabled since you didnt allow filevault to be enabled.

Run bdmesg and see if it has a single entry of the filevault disabler in config. Bet none.

 

You wouldnt find any of this:

21:835  0:000   - [19]: 850c08686ac53d7b90a5ddab2224de96 :: BinPatch :: [OS: 16.1 | MatchOS: 26.x | MatchBuild: All]

 

 

Can we take this in PM?   No need. we are not off-topic 😀

 

Edited November 19, 2025 by LockDown

[Max.1974]

Yeap I will send PM for you my friend 

 

My first installation with the patch worked perfectly, and every other installation without the patch always had FileVault enabled automatically.

Edited November 19, 2025 by Max.1974

[luxinhaus]

4 hours ago, Max.1974 said:

I recorded all process installation with my first configuration for Clover 

 

16 min of video... and FileVault is disable. 

 

  Reveal hidden contents

 

 

This Key Works 

 

 

 

 

@Slice what can you say about this? me says it's unformatted. Does not meet clover's patching definition

[Irish_Man]

If I’m understanding this correctly, you usually don’t need a Find value in an OpenCore kernel patch when you already give it a Base and Replace value.

When a Base is defined, OpenCore looks up the memory address of that symbol directly and doesn’t bother with whatever is in the Find field.

This approach is much more reliable, especially across small macOS updates.

Even if Apple shifts a function around in memory, the patch will still work as long as the function’s symbolic name (the Base) stays the same.

 

Find value is needed if:

You’re patching something inside a function, not at the very start of it, so there’s no dependable Base symbol for that exact spot.

You’re modifying code that shows up in more than one place, and the only way to target the correct instance is by matching the surrounding bytes with a Find pattern.

[Max.1974]

3 hours ago, Irish_Man said:

If I’m understanding this correctly, you usually don’t need a Find value in an OpenCore kernel patch when you already give it a Base and Replace value.

When a Base is defined, OpenCore looks up the memory address of that symbol directly and doesn’t bother with whatever is in the Find field.

This approach is much more reliable, especially across small macOS updates.

Even if Apple shifts a function around in memory, the patch will still work as long as the function’s symbolic name (the Base) stays the same.

 

Find value is needed if:

You’re patching something inside a function, not at the very start of it, so there’s no dependable Base symbol for that exact spot.

You’re modifying code that shows up in more than one place, and the only way to target the correct instance is by matching the surrounding bytes with a Find pattern.

 

Hi @Irish_Man Yes, I understand. In "my" (from OCLP) specific patch, I point to function X using Base because it has an exported symbol, so I can generally ignore the Find field in most cases. I would only need Find if I wanted to modify an internal section of that function or if the code pattern appeared in more than one place. Thanks!  

Edited November 19, 2025 by Max.1974

[Max.1974]

Hi all 

 

Tested patch for Opencore, and works fine with fresh install and with update  no need choose active or not FileVault. Just disabled. 

 

Lenovo T14