ASUS Vivobook 16 (M1607KA) UEFI password doesn't work after updating from 308 to 324 using EZ Flash.

[__Alex__]

Hi. I'm an ASUS Vivobook 16 (M1607KA) owner. I have just updated my UEFI from version 308 (I think) to the latest 324 using EZ Flash (built-in tool in UEFI settings). UEFI was protected with admin password. After this update I cannot enter UEFI - my password is no longer accepted! I'm sure that I'm entering it correctly. There was no indication that there were errors during the update. I have even used the process described in (https://superuser.com/questions/1907203/how-to-recover-reset-lost-uefi-password-on-asus-computer-w-a...) to save a dump of the updated UEFI from Windows and decrypt the password - it is the same as it was before the update, at least that is what the script returns. It is a simple 11 character upper and lower case alpha-numeric password without symbols, I have tried to input the first N < 11 characters in case there is a bug in the update like the allowed password length being reduced - to no avail.

Is there a way to rollback the UEFI to the previous 308 version without access to UEFI settings and EZ Flash? BIOS Update for Windows doesn't work since Windows sees that installed UEFI version is the same or newer than in the update (tried both 308 and 324 windows updates), so it does nothing. An I doubt waiting for the newer version to release will fix this, the stored password will probably only work on the 308 version.

Is there a startup key combination to initiate UEFI recovery from the USB flash drive? I have tried putting M1607KAAS.308 UEFI file as is and renamed to M1607KA.bin on a FAT32 formatted USB drive, and powering the laptop with it inserted and pressing ctrl+r, or ctrl+home after power on, or alt+r on the password screen - didn't work.

What else can I try to fix this? I can't even boot this laptop into any USB drive since it needs UEFI admin password for ESC menu before letting me choose which boot menu item to boot. And what is worse - this problem could have potentially happened without my intervention during automatic Windows update.

I'd like to avoid dealing with local support, since I would like to restore full functionality of my laptop as fast as possible. There should be an easy way to at least rollback the UEFI update. Never had such problems with HP and Lenovo laptops before, and they were always password protected in BIOS during updates.

[eyebrowz]

Hi

Dunno.

Internet search offers....

• At the UEFI password screen, press and hold Alt + r.

• If successful, an "Enter rescue password" window will appear showing the current date.

• Use the displayed date and an online ASUS rescue password generator to obtain a one-time rescue password (common tool: biosbug.com/asus).

• Enter the generated password to regain access and clear/reset the UEFI password.

ELSE

Method Requirements Effectiveness Notes

Alt + r (Rescue password)	At UEFI password screen	Medium/High	Depends on firmware/date, see biosbug.com
BIOS dump & decrypt	OS access (Windows/Linux)	Medium/High	For AMI BIOS; script required
Hardware programming	Professional tools	Risky/Service Only	New models' chips may be locked down
ASUS support	Proof of ownership	Certain	Only option for full lockout

AMI UEFI Dump Method (Password Recovery)

If the above fails and you have OS access (e.g., in Windows), you can extract and decrypt the password:

• Download the AMI Firmware Update Utility (AFUWIN/AFUDOS) from the official AMI website or via ASUS support.

• Use the utility to create a firmware dump file.

• Upload the .bin/.rom dump to a tool like AMITSESetup Decryptor (search for Alien Server, raaz.info.np) or use recovery scripts from GitHub.

• These tools extract the UEFI admin password embedded in the dump.

BUT as I say I dunno, depends a lot on the chipset apparently.

[Falcon_ASUS]

@__Alex__ 
Unfortunately, if the BIOS password is invalid and you are unable to access the system, the only solution is to send your laptop to a service center for further inspection.
The following is the contact information:
https://www.asus.com/support/service-center-location 

Also you can contact the local service center for help.
The following is the contact information:
https://www.asus.com/support/CallUs# 

Sorry for any inconvenience it may be caused.

[__Alex__]

@Falcon_ASUS 

Is there a way to downgrade the UEFI to the previous version from Windows? As I have said, I have full access to Windows, only UEFI settings are not available as well as booting from USB flash drives due to the correct password not being accepted.

This looks like a BUG in the UEFI update. To summarize - the password is the same as it was before the update, it was not changed. I have used AMI Firmware Update afuwin tool to read the current image of the UEFI and have decrypted the password - it is the same as it was when it worked in UEFI version 308, and it is the same password that I'm entering now. The password that is stored in NVRAM is the same and it is read correctly, so it must be a bug somewhere in the updated UEFI code or in the code that handles the updating process that breaks alphanumeric password verification after updating from version 308 to 324 if UEFI admin password is present at the moment of the update using EZ Flash.

Using UEFITool I have compared the checksums for volumes from the current image of the UEFI from my laptop to the UEFI image from the update file M1607KAAS.324 (version 324) that was downloaded from ASUS:

Volume GUID/Padding	Are they the same?	Comment
Padding	no	16 MB in size. Two blocks are present in the laptop image that are not initialized in the update file, and one block is different. Probably not a problem.
4F1C52D3-D824-4D2A-A2F0-EC40C23C5916	yes
96734D4B-1DDE-4627-867C-533EFCEACEE3	yes
3F8E4F19-8523-407F-8ACB-C562F5A36D35	no	This is free space in the update file. In the laptop image there is Non-UEFI data present at the end, including serial number, so not a problem.
FA4974FC-AF1D-4E5D-BDC5-DACD6D27BAEC	no	AmiNvramMainRomAreaGuid (so settings, etc., not a problem)
Padding	yes
61C0F511-A691-4F54-974F-B9A42172CE53	yes
61C0F511-A691-4F54-974F-B9A42172CE53	yes

I'm not an expert on UEFI, but since the main blocks are the same in the laptop image and the update file, and I'm assuming that the differences in the first 16 MB are normal, I can conclude that the update was applied successfully, so again, this looks like a bug in ASUS' UEFI code.

[Falcon_ASUS]

@__Alex__ 
What I can do at the moment is to forward the reported issue to the technical team for verification.
Since users currently cannot roll back the BIOS by themselves, if you need to restore normal UEFI functionality immediately, we still recommend contacting your local ASUS service center for assistance.
We apologize for any inconvenience caused.
 

** I have sent you a message, please provide me with your product serial number through the message.