> For people unfamiliar with C, strcmp is a routine used for checking if two strings are equal. This method receives three parameters: two strings and an integer, the latter states the number of characters to be compared. Afterwards, strcmp starts comparing each character until the end of any string is reached. Strings in C are just a chain of characters terminated by a \0 character, this means that strcmp stops comparing once any string reaches \0. Hence, by composing a Wii title in a way that its hash contains zeroes at the beginning, Starlet RSA computations will feed a string starting with \0 to strcmp. Thus, the comparison will always return equal… Title is signed!

This doesn't make sense. strcmp only needs two parameters (the two strings). Perhaps the article is talking about strncmp which takes a third "length" parameter which stops comparison after N characters. But in neither case would it behave as described in the article.

The only way to make it behave that way is if the code first did a strlen() on the channel's hash and then passed that in as the third parameter to strncmp(), which seems bizarre when you're comparing the fixed length output of a hash function...