turn off SIP and authenticated-root in recovery mode. mount system volume (not snapshot) to a editable user space create your own snapshot after modification. /System/Library/Displays/Contents/Resources/Overrides/ I guess Apple does some snapshot volume checksum in the boot in process to prevent illegal modifications.