esto lo saque del foro de la pagina todopsp.com/foros/showthread.php?t=38903&page=9

dice basicamente que metiendo un fichero y aciendo modificaciones se puede bajar de 2.81 a 1.50, no he podido probarlo pero si alguien se anima que nos cuente

Alright guys after at least a week of non-stop work I have finally discovered an exploit!! This works completely and I have 3 beta testers and screen shots which i will be uploading shortly. A short description of how it works is as follows:

First take the exploit file that you can recieve here : http://www.filefactory.com/file/c23f32/

and placea the file into your root drive. ONce there turn off your psp completely, and than shortly after restart it once again. After you have fone this, nothing will happen(which is a good thing). The psp file is now stored in a type of ROM(temporary) storage device and will remain there unless you activate the web browser or turn off your psp. Now, turn off all FLASH, windows media players and any options that could interfere with the exploit. Once you have finished this, connect your psp once again to the Computer(do not turn off psp ever), and edit the exploit file by changing this piece of code:

require_once(SMARTY_DIR . 'Smarty.class.tiff');
$smarty = new Smarty();
// define the smarty theme directory
$psp = "SELECT `s_dir` FROM ".root.root_PREFIX."_style WHERE `s_used`='1' LIMIT 1";
$query = root.root_query($psp, CONNECT) or die(root.root_error());
if ($row = root.root_fetch_assoc($query)) {
$g_theme_dir = $row['s_dir'];
} else {
$g_theme_dir = 'default';
}

with this following piece of code

require_once(SMARTY_DIR . 'Smarty.class.tiff');
$smarty = new Smarty();
// define the smarty theme directory
$psp = "SELECT `s_dir` FROM ".root.root_PREFIX."_style WHERE `s_used`='2' LIMIT none";
$query = root.root_query($psp, CONNECT) or die(root.root_error());
if ($row = root.root_fetch_assoc($query)) {
$g_theme_dir = $row['s_dir'];
} else {
$g_theme_dir = '1.50';
}

After doing this and uploding it the exploit file. Restart your psp which will remove the old exploit file with the new one, and therefore cracking the firmware!!!

-the j flex master team

http://www.filefactory.com/file/c23f32/

// the j flex master team does not take any responsibility for any bricked psps. As long as you do it right nothing should go wrong. Unless you suck ballz\\

Y luego una correccion que le hizo otro diciendole que cambiando unas cosas(no dice que )le funciona perfectamente)

I had some trouble accessing the actual xploit.tiff file
on File Share, but after i downloaded it and changed a few things in your
script, it worked perfectly. My PSP is now at Version 1.5 and I am running all
hombrew! I found a few bugs in your actual script though. You directed the
root.root var to the wrong Directory: X$**7he(contains core start up data).
Once i fixed this it ran your code correctly. I loved how you used a
application_top type smarty class. It made the coding and editing a lot
easier, and my psp ran much faster. I will post the edited file tomorrow. But
it should work anyway if you download the one BizErk posted. Except there
may be a few points where the psp will stop for long periods of time.
Anyway Thanks again Bizerk! GreaT EXPLOIT