You're right -- it's strncmp, not strcmp. The other missing piece is a property of RSA signatures: given message m, signature s, and public key (e, n), you veri

You're right -- it's strncmp, not strcmp. The other missing piece is a property of RSA signatures: given message m, signature s, and public key (e, n), you verify the signature by checking that H(m) = s^e mod n. Normally, this is not reversible without knowing the private factors of n, thanks to the discrete logarithm problem. But if s is zero, then s^e mod n will always be zero. So, if you brute-force m such that its hash starts with a zero byte, and change s to all zeroes, then the Wii computes strncmp(H(m) = '\0.....', s^e mod n = '\0\0\0\0...', length). Since both hashes start with null bytes, they are treated as empty strings and compare equal. Recommended resources https://wiibrew.org/wiki/Signing_bug https://wiibrew.org/wiki/Signing_bug, https://www.youtube.com/watch?v=0rjaiNIc4W8 https://www.youtube.com/watch?v=0rjaiNIc4W8