I will summarize what I have worked with slowly for some time now. As always for this type of modding, an external programmer is generally recommended
- I took the relevant files from a very recent ASUS Z890 BIOS (version 3202, released on the 8th of March 2026)
- I then verified this on 4 different motherboards: ASUS Z270I, ASUS Z370-A, ZX-99EV3, Jingsha X99-D8I
What GUIDs files to extract as .ffs files and replace using UEFItool 0.28?
- PkVar (CC0F8A3F-3DEA-4376-9679-5426BA0A907E)
- KekVar (9FE7DE69-0AEA-470A-B50A-139813649189)
- dbVar (FBF95065-427F-47B3-8077-D13C60710998)
- dbxVar (9D7A05E9-F740-44C3-858B-75586A8F9C8E)
How to verify that Secure Boot certificates have been updated correctly?
- After looking into this, it is my opinion that garlin’s PowerShell scripts are the best. Main discussion thread ; Releases on Github
Other possibly important updates
- My aim is typically fully working gaming computers for family and friends. To ensure that the integrated TPM (Intel PTT) was up to date on the Z270 and Z370 boards, I found that updating the ME region is needed
- Luckily, the user @MoKiChU has done some excellent work in this area already, and it was very easy to use: Link to ASUS Forum ; Link to ElevenForum