BackupMii can be accessed by selecting the gears on the home screen of BootMii, then selecting the leftmost icon.
While BackupMii is running, a chart of all blocks can be seen; there will always be a block highlighted to indicate that it is currently being worked on. As that square moves forward, blocks will be marked as backed up or bad, as they are backed up. There is also an optional step of checking to make sure the backup is valid; this is recommended to be safe.
NAND dump format
BackupMii creates a 553649152-byte NAND dump called "nand.bin" on an SD card. It is formatted as:
4096 * 64 pages of (2048 + 64) bytes of data + ECC A 1024-byte footer with keying information
Specifically, the format of that 1024-byte footer is:
256 bytes of human-readable information (e.g. "BackupMii v1\nConsole ID: 0408cafa"), padded with null bytes 128 bytes of OTP data (copied directly from OTP)
128 bytes of padding 256 bytes of SEEPROM data (copied directly from OTP) 256 bytes of padding
Console Keys and keys.bin
Instead of using WiiND, you can retrieve your console keys from the keys.bin file that BackupMii v3+ produces when backing up the NAND. To view them, open keys.bin with a hex editor.
Here are the offsets for each key:
boot1 hash: 0x100 (20 bytes) Common key (AES): 0x114 (16 bytes) Console ID: 0x124 (4 bytes) ECC Private Key: 0x128 (30 bytes) NAND HMAC: 0x144 (20 bytes) NAND AES key: 0x158 (16 bytes) PRNG seed (AES): 0x168 (16 bytes) ng_key_id: 0x208 (4 bytes) ng_sig: 0x20c (60 bytes)
For a full description of the purpose of each key, see this writeup on HackMii.