BackupMii

BackupMii
General
Author(s)	fail0verflow
Type	System tool
Links
Download
Website

BackupMii is the NAND-backup system in CEIL1NG_CAT that is responsible for backing up the filesystem and keys; RestoreMii is responsible for restoring the backup.

Accessing BackupMii

BackupMii can be accessed by selecting the gears on the home screen of BootMii, then selecting the leftmost icon.

Usage

While BackupMii is running, a chart of all blocks can be seen; there will always be a block highlighted to indicate that it is currently being worked on. As that square moves forward, blocks will be marked as backed up or bad, as they are backed up. There is also an optional step of checking to make sure the backup is valid; this is recommended to be safe.

NAND dump format

BackupMii creates a 553649152-byte NAND dump called "nand.bin" on an SD card. It is formatted as:

   4096 * 64 pages of (2048 + 64) bytes of data + ECC
   A 1024-byte footer with keying information

Specifically, the format of that 1024-byte footer is:

   256 bytes of human-readable information (e.g. "BackupMii v1\nConsole ID: 0408cafa"), padded with null bytes
   128 bytes of OTP data (copied directly from OTP)

   128 bytes of padding
   256 bytes of SEEPROM data (copied directly from OTP)
   256 bytes of padding

Console Keys and keys.bin

Instead of using WiiND, you can retrieve your console keys from the keys.bin file that BackupMii v3+ produces when backing up the NAND. To view them, open keys.bin with a hex editor.
Here are the offsets for each key:

boot1 hash: 0x100 (20 bytes) 
Common key (AES): 0x114 (16 bytes)
Console ID: 0x124 (4 bytes)
ECC Private Key: 0x128 (30 bytes)
NAND HMAC: 0x144 (20 bytes)
NAND AES key: 0x158 (16 bytes)
PRNG seed (AES): 0x168 (16 bytes)
ng_key_id: 0x208 (4 bytes)
ng_sig: 0x20c (60 bytes)

For a full description of the purpose of each key, see this writeup on HackMii.