This is a difficult task requiring RE. I don't think Bootmii even
loads IOS directly, which must be done to load libogc homebrew.
There's an MINI boot2 function to patch and load boot2 to run any NAND
title. Bootmii probably uses that function to boot sysmenu and HBC. I
tried to write an app to load IOS and a libogc app,(without doing any
RE) but the SRAM(0xffff0000) region seems to be protected. IOS seems
to load, but after a few seconds it executes a syscall and MINI
doesn't handle syscalls, so the panic disc drive LED begins to flash.
It might be possible to replace armboot.bin with an IOS kernel, and
write an simple ppcboot.elf to load an /boot.dol. However, this would
temporarily disable Bootmii...