Hacking error -2011 on virgin 4.0

[WiiPower]

Yes that's what i mean with unsigned.

 

[fogbank]

I managed to get my little app (IOS16 TMD downgrader) working by reading the TMD from NAND using ES_GetStoredTMDSize and ES_GetStoredTMD.
Now I may look into grabbing the cert from the NAND too.

I don't think it's possible to use the cert from the NAND. There are insufficient privileges on a virgin Wii to access /sys/cert.sys using ISFS, and grabbing the device cert using ES_GetDeviceCert works but the device cert cannot be used in the ES_AddTitleStart function (it's not the same as cert.sys).

I did manage to use my app to:

1. Downgrade the TMD of IOS16 v512 to 0.
2. Install IOS16 v257 using WAD Manager.
3. Upgrade the TMD of IOS16 v257 to 512.

Now the official System Update does not overwrite the trucha bugged IOS16 (tested - "No Update Available")