$Date: 2025-08-11 19:18:47 +0200 (Mon, 11 Aug 2025) $

VBoxManage modifynvram

VBoxManage-modifynvram 1
VBoxManage-modifynvram List and modify the NVRAM content of a virtual machine &product-name;
`VBoxManage modifynvram` uuid vmname inituefivarstore `VBoxManage modifynvram` uuid vmname enrollmssignatures `VBoxManage modifynvram` uuid vmname enrollorclpk `VBoxManage modifynvram` uuid vmname enrollpk --platform-key=filename --owner-uuid=uuid `VBoxManage modifynvram` uuid vmname enrollmok --mok=filename --owner-uuid=uuid `VBoxManage modifynvram` uuid vmname secureboot --enable --disable `VBoxManage modifynvram` uuid vmname listvars `VBoxManage modifynvram` uuid vmname queryvar --name=name --filename=filename `VBoxManage modifynvram` uuid vmname deletevar --name=name --owner-uuid=uuid `VBoxManage modifynvram` uuid vmname changevar --name=name --filename=filename

## Description

The "modifynvram" commands are for experts who want to inspect and modify the UEFI variable store of a virtual machine. Any mistakes made here can result in a non-bootable virtual machine.

### Common options

The subcommands of `modifynvram` all operate on a running virtual machine:

`uuid | vmname`

  Either the UUID or the name (case sensitive) of a VM.

### modifynvram inituefivarstore

Initalizes the UEFI variable store to a default state. Any previous existing variable store is deleted. Use with extreme caution!

### modifynvram enrollmssignatures

Enrolls the default Microsoft KEK and DB signatures required for UEFI secure boot.

### modifynvram enrollorclpk

Enrolls the default platform key provided by Oracle required for UEFI secure boot.

### modifynvram enrollpk

Enrolls a custom platform key provided by the user required for UEFI secure boot. The following commands use openssl to generate a new platform key:

    $ openssl req -new -x509 -newkey rsa:2048 -keyout PK.key -out PK.crt

    $ openssl x509 -in PK.crt -out PK.cer -outform DER

`--platform-key=filename`

  The platform key provided as a DER encoded X.509 signature.

`--owner-uuid=uuid`

  The UUID identifying the owner of the platform key.

### modifynvram secureboot

Enables or disables UEFI secure boot.

`--enable`

  Enables UEFI secure boot if the state of the key enrolment permits.

`--disable`

  Disables UEFI secure boot.

### modifynvram listvars

Lists all UEFI variables in the virtual machine's store along with their owner UUID.

### modifynvram queryvar

Queries the content of a given UEFI variable identified by its name.

`--name=name`

  UEFI variable name to query.

`--filename=filename`

  Where to store the content of the variable upon success. This is optional, if omitted the content will be dumped to the terminal as a hex dump.

### modifynvram deletevar

Deletes the given variable identified by its name and owner UUID.

`--name=name`

  UEFI variable name to delete.

`--owner-uuid=uuid`

  The UUID identifying the owner of the variable to delete.

### modifynvram changevar

Changes the UEFI variable content to the one form the given file.

`--name=name`

  UEFI variable name to change the data for.

`--filename=filename`

  The file to read the data from.