Don't bother wasting time messing around with the update EBOOT.PBP, it's all been tried before, it's easy to get past the first version check, but the second check is in the encrypted code!

Also, can someone please explain how the following works?

"This works by overloading the psp audio with a glitch sound, and overloading the image handler with overflow.tif, thus in conjuction overriding the TIF patch."

Does the ATRAC 3 decoder have an exploitable buffer overflow bug? I am skeptical, but if anyone has proof... Anyway, like many other had already said, getting the PSP to crash doesn't mean you have found an exploitable bug.