That would easily work if there are no checksums applied.
Checksums would be the only problem but that can be easily fixed if we identify the checksums position and while patching the category we also patch with the corresponding checksum.
We dont know if there is some checksum that affects the area where is needed to patch the 2 bytes of CATEGORY, this idea of the cheksum is something suggested by
@Zar and initially i agree that is posible to exist some checksum used for safety/redundancy purposes (not for security) just to verify that the data you are reading from the database is correct
Anyway, as you metioned, if that checksum exists, it also exists the posibility of patching it

Finding where is the checksum is going to be a pita though, it seems by allowing the firmware to update the database "in the official way" there are lot of values that changes
One of the good things we have playing at our favour is the database file is not critical... if at some point is damaged or corrupted, the firmware probably have a "database manteinance plugin" that is going to either fix it... or rebuild a new database entirelly from scratch
So we have a safety web while making experiments
Btw, there seems to be multiple .sprx plugins related with database manteinance, the name of this one looks specially interesting:
mms_maintenance.sprx
And this one:
mms_minimdimp_media_hdd.sprx
Reserve all 128, PARAM.SFO should have param_max_len and param_len to 0x80 and be null padded. The entry bytes will be stored with in database (DB doesn't make checks on strings, endocing, etc it simply copies the bytes). The trick is that when the XMB reads the data from db it will get all the 128 bytes and try to parse it in a string. It should stop at the first null byte since that serves as terminator. All the app has to do is write the bytes of the updated title and a null byte.
Yep we know, we was discussing the fact that using a PARAM.SFO (in the first installation) with a TITLE length of 128 characters (using lot of 0x20 bytes at the end to fill it with spaces up to 128) is going to be "failproof" because this way the database structure is going to reserve them (ready to be modifyed later by non-official ways)
But the problem of doing that is visual... when you display that string in XMB is going to be animated with a horizontal scrolling (the texts moves from right to left)
And most of it (the characters most at right that are spaces) are going to be displayed as empty, so it will look like an error
For the initial tests "to play safe" we could ignore the visual annoyance and do it with the 128
The other intermediate solutions (different than 128) are:
Reserve the max of characters allowed before that scrolling animation starts
This is going to work nice for some homebrews and other uses... like what
@Zar was mentioning, he had an option in a previous managunz versions to "update managunz" where the app was downloading a PKG from network, then it was extracting his contents, and then it was overriting the files inside managunz installation path
Overall it was working fine, but the problem is the new version of the PARAM.SFO included a different TITLE (as example: ManaGunZ v1.35)... that "v1.35" was not displayed correctly when exiting back to XMB
Reserve only the amount you need
In the case i was mentioning of managunz (and it at some point we are able to patch the database to change the TITLE) is easy to solve, because we know all the TITLE of all managunz versions (previous and future) are short, the string "ManaGunZ v1.35" needs 14 bytes + the NULL so we could reserve lets say... 16... or 18 or so (trying to not trigger that scrolling animation)
Reserve some, but we are not sure how much
For the "PSP Launcher" we cant solve the problem so easilly though :/
We need to make a TITLE reservation inside the database structure that covers the max lenght of the longest game TITLE officially published for PSP
I wonder if there is some database with all the complete collections of the PSP game catalog (redump.org maybe?)... this would help us to know how much bytes we need to cover all the PSP game catalog
Im guessing we dont need the 128... with 64 should be enought... or even less, but who knows...
Anyway, a dirty way to fix this if at some point the user tryes to boot a PSP game with a masive lenght TITLE then our "custom code" should not copy the TITLE string entirelly into the database
It will look bad, but it should work
------------------------------
Btw, the reason why i think this way of patching the database manually is going to work fine with the CATEGORY (and the others around the area i was using as example in my previous posts) is because by looking at the database file structure it can be seen that area is generated (by the database manteinance service) by doing simple copypastes of data from real PARAM.SFO ---to---> database
The only change made to some values is the endianess swap, but the lenghts are exactly the same in SFO and the dabatase
And all that values are stored a single time... so if we change the value in the database and in the real SFO then we have changed 100% of the info about it
The other info related with the value is his lenght, but we are not changing it... so the PS3 doesnt even realizes what happened... for the "database manteinance" service/plugin is the same stuff before and after
In my oppinion patching the CATEGORY (and most of the other values around it) have a huge probability to work in a simple way
For the TITLE im not so sure, because appears in lot of places, maybe this is going to be more tricky, but im keeping open mind and considering all posibilities, one of the posibilities is simply to forget about the TITLE by now (dont change it when updating the SFO, neither in the database), and focus in the CATEGORY first