Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Yesterday, I added a password containing a ! to my BIOS. Unfortunately, the password prompt that asks for the password when you boot doesn't let you write a ! (i.e. the little * isn't added and it tells me it's the wrong password).

So I Googled how to remove that password and stumbled upon this previous question.

So I have 3 options:

  • Miraculously find a way to enter a !

  • Find someone at ASUS that can give me the rescue password

  • Open up the computer, remove everything that could provide power to the motherboard and hope that it either removes the password or resets the date to a date for which the rescue password is known

  • Somehow use the long list of codes linked in the previous question to reverse engineer the algorithm generating the code and use that to generate the code for today

Any help in either direction is welcome.


About finding a way to write the !, my computer has a QWERTY keyboard so ! is Shift + 1. I also tried to write it using Caps Lock but it didn't work. Since my keyboard was originally an AZERTY and I changed it, I also tried using it as an AZERTY or plugging a USB AZERTY keyboard but both were considered as QWERTY keyboards (or at least as keyboards where the keys that add little *s are exactly the same as on QWERTY keyboards).

I also tried (as suggested in an answer) to use the ASCII code 33 for ! but Alt looks like it gets ignored since it adds two *s.

So a solution in that direction seems unlikely.


About finding someone at ASUS, I tried the customer support in France by phone and in North America by chat. Both told me that I had to send it to a repair center and that it would be an out-of-warranty repair because it concerned the BIOS. And either they didn't know the rescue code existed or they weren't allowed to even mention its existence.

I also tried to ask to ASUS Twitter feeds. I got answers telling me to contact customer support directly and one answer from ASUS France telling me to log into Windows and change the date to a specific date for which they had the rescue password. Unfortunately, I am prompted for the password whenever I boot so I can't get into Windows.

I also sent emails to every customer support thing I found but so far I didn't receive any other answer.


I could open the computer and I already did it once to replace the keyboard. But I really would prefer not to mess with things I don't understand again. Plus I'm not even sure it'll reset either the password or the date. So that's my last resort solution.


I haven't been able to recognize any pattern in the sequence of rescue passwords.

Here's what I have so far (top line is character, left column is indice at what index it appears in the string):

          0     1     2     4     9     A     B     C     D     H     L     O
    0   237   246   106   109   106  1243   575   109   215   105   355   244
    1   220   215    95   100   125  1265   575   120   245   140   310   240
    2   200   240   120   120   120  1201   620   110   280   110   299   230
    3   230   190   130   130   140  1240   561   110   209   100   370   240
    4   280   210   120   110   100  1170   620   100   240   100   340   260
    5   120   360     0     0    60  1171   949    60   120   240   480    90
    6   240     0   111     0     0  1260   720     0   600     0   719     0
    7   190   240   120     0   120  1079   941   120   480     0   360     0
Total  1717  1701   802   569   771  9629  5561   729  2389   795  3233  1304

Other things tried:

  • I tried entering 3 wrong passwords as suggested in this page linked in the previous question but instead of giving me a code, it gets stuck on Invalid Password.

Potentially relevant information:

  • It's an ASUS RoG G751JY bought about a year ago

  • I did a fresh install of Windows (so there is no more recovery partition)

That's it. Thanks in advance for your help.

share|improve this question
    
I really Recommend Doing the Answer @Prasanna stated there may be some options in this Article But in the end if you dont want to spend quite a while trying different things when you know you can just reset it and get it over with. – NetworkKingPin Feb 27 at 11:27
2  
Have you tried some weird possibilities like entering 1 instead of ! or the key to the left of the right Shift? (In my keyboard it is a -, in the US keyboard is a /, in this AZERTY it is a !) – Margaret Bloom Feb 27 at 12:09
1  
No, it was just *s. I do remember clearly that it rejected other non alphanumeric characters, and I only kept the ! because it's the only one that made a * appear... – xavierm02 Feb 28 at 16:22
3  
@ja72, only the other day I took a bit of tin foil to bridge two easily accessed jumpers on my mum's recent Acer Aspire Laptop in order to reset the CMOS and clear the password. Worked a treat. – spender Mar 1 at 23:35
1  
On a netbook I bought which the previous owner had forgotten the BIOS setup AND boot password to (got it for an amazing deal because it was useless) I was able to remove the password by doing a low-level bios rescue. This was a Gateway/Acer brand netbook. I also tested and can confirm that fully flashing the BIOS/EFI from DOS will remove a BIOS setup password. (A full flash being more than what a typical BIOS update flashes, and is a bit more dangerous as the BIOS bootblock will be in a vulnerable state during the flashing process.) – Hydranix Mar 2 at 20:05
up vote 113 down vote accepted

Proven option
I have always been successful in resetting the BIOS by removing the CMOS battery. I'd recommend removing the power to the laptop and then remove the CMOS battery. The bios battery looks like this and it keeps track of time and BIOS contents.
enter image description here

Wait for a couple of minutes. This action will reset the contents of the BIOS and will let you enter without any passwords.

If you need instructions on how to open your laptop, you can look at the YouTube video here

share|improve this answer
20  
@xavierm02 it won't just reset the date, it will also reset the BIOS to factory defaults, and thus reset the password. – Nzall Feb 27 at 11:22
7  
@NateKerkhofs Oh. I thought I had read somewhere that in new computers, the password is sometimes stored somewhere that doesn't get reset... – xavierm02 Feb 27 at 11:26
10  
I too had the impression that the password, and bios, were now stored in flash resther than battery-supplied memory, specifically to improve security. Then again, I'm surprised it would accept a password you can't enter, so I'm inclined to think you mistyped something. – keshlam Feb 27 at 12:20
2  
It certainly should be removed. I've never heard of or seen a BIOS to have such functionality in its setup utility. – Ruslan Feb 28 at 18:00
7  
Many modern UEFI-based systems indeed store configuration in EFI variables, which are stored in Flash, which will not be reset when removing the CMOS battery. – Jonathon Reinhart Feb 29 at 0:30

(Not an answer to the question as stated in the title, but a way to solve the underlying problem nonetheless).

I think I managed to (mostly) reverse engineer the algorithm that generates the rescue password from the list of past passwords. Unfortunately, I do not own an ASUS board, so I cannot verify whether this correctly predicts new passwords, however running the snippet posted below on dates where the password is known always gives the correct result. If you gives this a try and it does or doesn't work for you, let me know.

Just by looking at the given data in various ways (e.g. by making a table of passwords for a fixed day of the month), one can see a few patterns emerge.

If we label the letters in the password like this: 01234567, then it's easy to see that letters 6 and 7 are uniquely determined by the day of the month (and thus are completely independent of the month or year). For letter 7, simply use the zero-based day of the month as index into the string AAAABLDDBB0LB211C9BAAAAABLDDBB0. Similarly, for letter 6 it's the string LBAL0AL0ADLADLADLADBADBABBAB2AA.

For letter 5, it's also easy to see that in addition to the day of the month, the parity of the month (i.e. its remainder when divided by two) also matters. For odd months, one has to use the reference string BADBOA01AAH1ABBALLBABLBAH1ADL1A, for even months it's A0CAABALBBALBBAH1ABH1ABLABL9ABO.

Letters 2, 3 and 4 are very similar, one just has to use a different lookup table for each month (i.e. each of those letters has twelve lookup tables).

Letter 1 also takes the parity of the year into account. So here one has 24 total lookup tables, 12 for odd years and 12 for even years. Many of these lookup tables actually contain the same letters in the same sequence, they just start at a different point in that sequence. I guess this indicates there's some underlying pattern I haven't quite managed to figure out yet.

Letter 0 is a bit more complex, and I have not yet been able to fully determine a pattern. It seems that depending on the month and year, one of 4 fundamental sequences (OLLAA1AO, ADBA4CAL, AD2AH9AB, AB1A0BB0) is selected and rotated by some specific amount. However, it also seems that the years 2002-2009 follow a different pattern than 2010 and 2011 (in fact, 2010 shows the same behavior as 2008, and 2011 as 2009), so it's very hard to predict how this sequence continues anyway.

Instead, since at this point we already have 7 out of 8 letters determined, and there seem to be only 12 possibilities for the final letter, one could just try to bruteforce the password. If you systematically try out the missing letter by frequency in the 4 sequences mentioned earlier, you should already have a 50% chance of getting the correct password after 2 attempts.

Below is a snippet of Javascript that when run asks you for a date and shows the 12 possible passwords for that date, sorted by likelihood. For today's date (2016-02-28), this would give you X0BLB9BD, with X being one of ABLOD10942CH.

(function() {
    let today = new Date();
    let date = prompt("Enter a date", today.toISOString().substring(0, 10));
    let tables = [
        [["AAAABLDDBB0LB211C9BAAAAABLDDBB0"]],
        [["LBAL0AL0ADLADLADLADBADBABBAB2AA"]],
        [["BADBOA01AAH1ABBALLBABLBAH1ADL1A", "A0CAABALBBALBBAH1ABH1ABLABL9ABO"]],
        [["A49BLA0ODBLA0OD1ALAOD2ALABCA0OA", "BCA0AHBL20A4BLBAOADLBA0AD1ABA", "1ABAA9BLAAACBLA0OD2LAHBD2ALABL2", "ALAB1A0AHB1A0A4BLBAA49BBA0AD1L", "0AD1ABAA91ALAACBLAHACA0AHBD2AAH", "BD2AOAB1AAOAB1A0A491ABA49BBA0A", "BBA0OD1AB0OD1ALAACAALABCA0AHB1A", "0AHBL2AOABLBAOAB1ABOAD1ABA49BAB", "A49BLA0ODBLA0OD1ALAOD2ALABCA0O", "0AHBL2AOABLBAOAB1ABOAD1ABA49BAB", "A49BLA0ODBLA0OD1ALAOD2ALABCA0O", "BCA0AHBL20A4BLBAOADLBA0AD1ABAOD"]],
        [["DA1HABBDAA24ABBLA244A9LLABAA99O", "9LLA2AA9LLBABAACOBAALBACOAALB", "BACOBALBAA10AALDA100AO0DA1HAOOB", "O0DA1HAO00DA1HABBDAA24ABBLA244", "4ABBDA24AA9LLA2AA9LLBABAACOBAAL", "ABAA9OBABBBACOBALBAA10AALDA100", "0AALBA10AAO0DA1HAO00DA1HABBDAA2", "A1HAOBDA114ABBDA24AA9LLA2AA9LLB", "LLA24A9LLLABAA9OBABBBACOBALBAA", "LA24A9LLAABAA9LBABAAACOBALBACC0", "COBABBACOOAALBA10AAA0DA10AO0DD", "DA10AO0DAA1HAO0DA1HHABBDA24ABBL"]],
        [["LA24ABBDAA1HAO0DA1H0AALBA10AAAB", "1HAOBDA1H0AALDA10AAABAACOBABA", "AO0DA10AAALBACOBABAAA9LLA24ABBB", "LBACOBABAAA9LLA24ABBBDA1HAO0DD", "A9LLA24A9BBDA1HAOBDDA10AA0DA1CO", "BDA14ABBDDA10AO0DA1COBALBACOBL", "A1HAO0DA110AALBACOBBABAA9LLA224", "0AALBACOBBABAA9LLA224ABBDA1HAAO", "ABAA9LLAB24ABBDA14AAO0DA1HAO0L", "AO0DA10AAALBACOBABAAA9LLA24ABBB", "LBACOBABBAA9LLA24A9BBDA1HABBDD", "A9LLABAA9BBDA24ABBDDA1HAO0DA1CO"]],
        [["BL4AA20BAAAA2HBA1LDBHBA1ODA90A1", "ODA9BBAOBACBDAOL4AADABLAAA20B", "AA2HBA1LDBHAA1ODA9BA1OLACBBAOLA", "CBDABL4AADABLAAA2HB0AAABHBA1OO", "HAA1ODA9BA10LACBDAOLACLDABLAALD", "AB0AAA2HB0BAABHAA1OOB4AA1OLACA", "10LACBDABBACLDABLAALDA90AAABH90", "BAOBHAA1OOB4AA10LACAA20LACLDA0B", "A1LDAB0AALDA90BAABH9BBAOB4AA1A", "OLA9BBAOLACBDABL4AADABLAAA2HB0A", "AA2HBA1ODBHAA1ODA9BA1OLACBDAOL", "CBDABLAAADAB0AAA2HB0AAABHAA1OOB"], ["BAABHAA1OOB4AA1OLACAA10LACLDA0B", "ACLDAB0AALDA90AAABH90BAOB4AA", "L4AA10LACAA20LACLDAHBA1LDAB0A1O", "DA90BAABH9BBAOB4AA1AOL4AA10LAA", "A20BACLDAHBA1LDA90A1ODA90BAOBAC", "BBAOB4AA1ABL4AA20LAAAA2HBA1LDB", "BA1ODA90B1ODA9BBAOBACBDAOL4AADA", "BLAAA20BAAAA2HBA1LDBHAA1ODA90A1", "OLA9BBAOBACBDABL4AADABLAAA20B0", "A1LDAB0AALDA90BAABH9BBAOB4AA1AO", "L4AA10LACAA20BACLDAHBA1LDA90A1", "DA90BAOBH9BBAOB4AA1AOL4AA20LAAA"]]
    ];

    let match = date.match(/^(\d{4})-(\d{2})-(\d{2})/);
    if (!match) {
        alert("Invalid date: " + date);
        return;
    }

    let [_, y, m, d] = match.map((a,b) => +a)

    let pass = "";
    for (let i = 6; i >= 0; --i) {
        let letters_map = tables[i];
        let year_map = letters_map[y % letters_map.length];
        let month_map = year_map[(m - 1) % year_map.length];
        pass += month_map[d - 1];
    }

    let final_letters = "ABLOD10942CH";

    let output = []
    for (let x = 0; final_letters[x]; ++x)
        output.push(final_letters[x] + pass);

    alert(output.join("\n"));
})();
share|improve this answer
8  
That's awesome. I can confirm that the 5th password indeed works. (But I did have to fix some parenthesis mismatches, add the "use strict" and replace let array-let by a series of let) – xavierm02 Feb 28 at 8:01
40  
@xavierm02: For people stealing computers the solution of simply removing the BIOS battery is by far the easier one. – Joey Feb 28 at 9:42
11  
@xavierm02: Thanks for the confirmation and sorry about the JS trouble - the snipped should work just fine when pasting it into the Firefox browser console. Also I have to agree with Joey, if someone has physical access to a machine, a primitive protection like a BIOS password is not going to prevent them from using the machine. – tmnt Feb 28 at 13:00
2  
@xavierm02 If it took a day for him to work out the algorithm the main thing it shows is that having such an easy rescue password renders the whole thing insecure in the first place. If ASUS read this it should prompt them to take such a stupid back door out. – JamesRyan Feb 29 at 14:55
27  
Actually, this is quite remarkable that you managed to figure this one out. – Shotgun Ninja Feb 29 at 15:36

Alright I got it working again.

I opened the slot at the back where you can see hard drive and some memory sticks. Next to the memory sticks, there are two little things labeled JRST2001 and JRST2002. I first tried to connect one to the other, and then my computer wouldn't even boot, the only thing that light up was the leds next to the keyboard. So I then tried to connect the two "sides" of JRST2001 (there's some kind of line going through it) and same for JRST2002. It then reset the date to 2009-01-01 for which the rescue password is 1BLDABLA. Note that when you enter the rescue password, the computer freezes and you have to manually reboot. Then, since it kept booting into the bios for no apparent reasons, I started changing settings randomly until it worked. And apparently the good setting was the CSM which I needed to enable.


For the record, here's the answer I got from ASUS (emphasis mine):

(I wasn't sure whether this should go in my question or in my answer but I figured people wouldn't want to scroll though that whole thing to get to answer, so I put it here)

Hello Dear Xavier,

Thank you for contacting our ASUS Support.

Following your request, for the computer whos model is G751JY, i understand that you are unable to enter "!" to pass the Bios password and you want to have the rescue password.

Mister Xavier, first of all, i am very sorry to inform you that the BIOS password can be crushed only in our workshops, and this, unfortunately, with a return out of warranty of your computer.

Therefore, to return your computer to diagnose and workshop by ASUS expert, thank you kindly complete the removal form from the following link:

https://eu-rma.asus.com/pick_eu/fr/

Click on the type of product << Notebook >> to complete all required fields.

I invite you to describe as accurately as possible the course "Problem description" so that our technicians can detect and repair the malfunction best of your product.

To validate your pick form, all required fields must be filled and you must check the "Guarantee Agreement provided."

I highly recommend you to click the hyperlink to access the Asus warranty conditions and read them carefully, especially Section 2.2.3.

Once your application is approved, you will receive from us an email with your return agreement number out of warranty and instructions for removal (packing instructions and the general conditions of the After-Sales Service) .

You should have informed a mobile phone number. You will automatically receive information about the status of your repair for each stage.

To track the repair status you can check the box 'I agree to receive SMS information on the status of my repair folder'.

Once the product is received in our service, technicians will make a diagnosis of the failure and will send you a repair estimate.

Then you have the ability to communicate directly to the workshop you wish to continue or not to repair your product.

In case of refusal quote I inform you that the diagnostic fee and the shipping cost will be your responsibility. (~ € 75)

I remain at your disposal, Mr. Xavier, for any additional questions and I wish you a good day.

share|improve this answer
10  
You are describing the jumpers for resetting the BIOS I believe – Prasanna Feb 27 at 17:38
68  
Also, you don't usually want to try randomly connecting metal things together on a motherboard. Get the manual first and figure out what can safely be modified or you'll end up not only resetting the BIOS, but frying the board as well. – isanae Feb 27 at 18:48
29  
Randomly joining electronic components without the slightest clue what they are (let alone what they do) is not the brightest idea in the world. Perhaps leave the electronics alone until you can go beyond calling everything "thingies"!! – Lightness Races in Orbit Feb 27 at 19:59
13  
In future, this sort of thing would be in the manual, and its seriously worth reading it. And if you had shorted + and - voltage headers of any sort, which I'd add are often next to each other, that might be bad. – Journeyman Geek Feb 27 at 23:07
34  
"I started randomly changing settings" This is exactly the kind of thing that leads to posting another SuperUser question: "Help meee, my computer doesn't work again!" – David Richerby Feb 28 at 23:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.