diff --git a/src/libWiiPy/title/ticket.py b/src/libWiiPy/title/ticket.py
index 697a1f7..d55f344 100644
--- a/src/libWiiPy/title/ticket.py
+++ b/src/libWiiPy/title/ticket.py
@@ -234,6 +234,9 @@ class Ticket:
         older IOS versions that incorrectly check the hash using strcmp() instead of memcmp(). The signature will also
         be erased and replaced with all NULL bytes.
 
+        The hash is brute-forced by using the first two bytes of an unused section of the Ticket as a 16-bit integer,
+        and incrementing that value by 1 until an appropriate hash is found.
+
         This modifies the Ticket object in place. You will need to call this method after any changes, and before
         dumping the Ticket object back into bytes.
         """
diff --git a/src/libWiiPy/title/tmd.py b/src/libWiiPy/title/tmd.py
index 752e7f7..d398da1 100644
--- a/src/libWiiPy/title/tmd.py
+++ b/src/libWiiPy/title/tmd.py
@@ -235,6 +235,9 @@ class TMD:
         older IOS versions that incorrectly check the hash using strcmp() instead of memcmp(). The signature will also
         be erased and replaced with all NULL bytes.
 
+        The hash is brute-forced by incrementing an unused 16-bit integer in the TMD by 1 until an appropriate hash is
+        found.
+
         This modifies the TMD object in place. You will need to call this method after any changes, and before dumping
         the TMD object back into bytes.
         """