I was just thinking, would it be possible to take an update EBOOT, extract the PSAR and change the files in the flash, but keep them the original sizes so the PSP doesn't know they've been modified. You could change it so maybe it doesn't look for Sony's signiture on games, or, if not that, put an easily exploitable flaw in it. Then you would update. Unless the PSP also checks how recently the file has been modified.