Effectively, they're using strcmp with memcpy on the same data -- it's just ridiculously stupid.
All software (code+data) on the Wii must be signed, but the code burned into the supervisor chip does a strcmp on the raw binary signature. It's pretty trivial to generate a hash collision when you can force only the first byte to be compared :)
Effectively, they're using strcmp with memcpy on the same data -- it's just ridiculously stupid.