Skip to content

Namco System 357 / 369 (PS3-based arcade)

The System 357 (2007, for Tekken 6) and its evolution System 369 (2011, Tekken Tag Tournament 2) are, literally, PlayStation 3s in a metal chassis + two Namco boards (I/O + JVS). The game lives on a hard drive paired to a dongle. This page gathers everything: hardware, mounting/reading the disk, and the tutorial to convert a retail PS3 motherboard to replace a dead arcade motherboard.

Method, not piracy

We document how it works and how to repair/preserve (replace a dead motherboard with a PS3 donor). We host neither the GEX firmware, nor keys, nor HDD/dongle dumps. Content is made from your own hardware (your dongle, your original game HDD).

Overview

Field Value
Base retail PlayStation 3 (motherboard with Product Code ARC = 0xA0)
Board specifics no WiFi/Bluetooth module, no Blu-ray drive (nor integrated BD controller beyond CECH-25xx)
Added Namco boards 1× I/O board + 1× JVS board (JVS / "JAMMA 2" standard)
Game media hard drive (HDD) pre-installed, paired to a dongle
Video out VGA (HD-15) via the JVS board; RCA L/R audio
Case metal "rack assy" (S357-07J, S357B-08J/E, S357C-10J, S357C-11E, S369C-11J/E)

Variants (crucial to repair/convert)

System Motherboard Serial Flash PS3 base Typical games
357A COK-002 GECR-1100 NAND Fat Tekken 6, T6 Bloodline Rebellion
357B VER-001 GECR-1500 NOR Fat T6 / T6BR, Razing Storm, DeadStorm Pirates
357C JTP-001 GECR-2500 NOR Slim Gundam Extreme Vs (Maxi/Full Boost), DBZ Zenkai, Taiko
369 JTP-001 GECR-2500 CU1 NOR Slim Tekken Tag Tournament 2 (Unlimited)
  • 357C = 369 except: the 357C has a single USB cable, the 369 has a USB hub (3 ports + JVS input). The 369 reportedly has an overclocked RSX/memory vs the 357s.
  • Sub-revisions: ...-11E = no H0xx I/O, with USB hub (Taiko, rail-shooters); live-monitor = demo cabinets (show networked live play, not playable).

357 ≠ 369

357 games don't run on 369 (and vice versa): system-specific checks and different HDD crypto. Identify your target correctly.

Where a game lives: HDD + dongle

  • The game is pre-installed on the HDD, paired to a dongle (HDD and dongle go together; the serial printed on the dongle matches the HDD ref).
  • On first boot, the game auto-installs its updates:
  • game: /dev_hdd0/game/SCEEXE000/ARCDIR/INSTALL0.PKG
  • firmware: /dev_hdd0/game/SCEEXE000/ARCDIR/PS3UPDAT.PUP
  • The arcade firmware allows installing packages ("Install package files" icon in the game column).

The HDD key (the key technical point)

The hard drive is decrypted by a static key inside lv1ldr when the Product Code = 0xA0 (ARC). The lv1/lv1ldr is identical to retail models — it's the ARC Product Code that unlocks decryption of the arcade HDD. This is the whole point of the conversion (see below).

Games / HDD / dongle table (per-system compatibility)

Year Game HDD ref Dongle 357A 357B 357C 369
2007 Tekken 6 TE6100-1-NA-HDD0-A TE61 ✅
2008 T6 Bloodline Rebellion T6B100-1/2-NA-HDD0-A T6B1 / T6B2 ✅
2009 Razing Storm RST100-2-NA-MPR0-A RST1 ✅ ✅ ✅
2010 DeadStorm Pirates DSP100-2-NA-MPR0-BXX DSP1 ✅
2010 Gundam Extreme Vs. — — ✅
2011 DBZ Zenkai Battle Royale — — ✅
2011 Taiko no Tatsujin (series) ST*100-…-HDD0 — ✅
2011 Tekken Tag Tournament 2 — — ✅
2012 Gundam Extreme Vs. Full Boost GEX100-1-NA-HDD0-A GEX1 ✅
2012 Tekken Tag Tournament 2 Unlimited TG2100-1-NA-HDD0-F17 TG21 + DTT2G ✅

(Non-exhaustive — see the PS3 Dev Wiki for the full table, including "Live Monitor" versions.)

The I/O and JVS boards (assembly & reading)

Signal chain:

Buttons/stick/coin → I/O board → JVS board → (USB) → PS3 board
Video: PS3 board → (AV MultiOUT) → JVS board → VGA → monitor
Audio: JVS board → white RCA (L) / red RCA (R)
  • I/O board (top): 24-pin connector, 8 DIP switches (DIP #2 = enable 31 kHz), 10-pin connector.
  • JVS board (bottom): USB (JV I/O JAMMA interface), DC IN +5 V (powers the Namco board — 357A/357B only), VGA (video), RCA L/R (audio).
  • On later models (357C/369), the I/O + JVS are replaced by a "USB I/O PCB" (identifier US1001 / USIO01) — visible in the test menu (I/O PCB : Connect OK … NBGI.;USIO01;…).
  • JVS = Jamma Video Standard ("JAMMA 2"): HD-15/VGA video, RCA audio, JST VL power, serial board↔I/O protocol. See JVS.

Mounting & reading the disk (procedure)

  1. Identify your target (357A/B/C or 369) and the game's HDD + dongle pair.
  2. Connect the game HDD into the PS3 board's bay (2.5″ SATA, like a PS3). The HDD is encrypted: it only reads on a board with Product Code ARC (arcade or converted).
  3. Insert the dongle (USB/I/O port depending on model — see the game manual, e.g. Razing Storm §5.5 "inserting the dongle").
  4. Connect I/O + JVS (or the USB I/O PCB), VGA to the monitor, audio.
  5. First boot: the game auto-installs its updates (INSTALL0.PKG / PS3UPDAT.PUP) — do not cut power (XMB message "Copying update data… Do not turn off").
  6. Test menu: check MEDIA SYSTEM357 HDD + I/O PCB : Connect OK, set clock, cabinet type, language, HDD CHECK.

Mount & EDIT the HDD on a Linux server (decryption)

The arcade HDD is encrypted (like a PS3 HDD). To read/edit its content (game files in dev_hdd0), you decrypt it on the fly under Linux via device-mapper (dm-crypt), then mount the partitions.

Work on a COPY, never the original

Always work on a dd image of the HDD, not the original disk. The HDD is paired to the dongle: corruption = dead game. And never clear the ATA keys while a partition is mounted (guaranteed corruption).

1. The encryption model (depends on the model!)

System Motherboard Flash HDD encryption VFLASH
357A COK-002 NAND (Phat) AES-CBC-192 (zero IV) AES-CBC-128
357B VER-001 NOR (Phat) AES-CBC-192 XTS-AES-128
357C / 369 JTP-001 NOR (Slim) XTS-AES-128 XTS-AES-128
  • XTS-AES-128 (Slim): each sector encrypted independently; the key = data key (16 B) + tweak key (16 B) concatenated (256-bit). VFLASH = encrypted twice (ENCDEC then ATA).
  • The keys (ATA data/tweak + ENCDEC) derive from the eid_root_key. For arcade (Product Code ARC = 0xA0), the HDD key is static (in lv1ldr) → decryptable offline with the right key.

The dev_hdd0 filesystem is UFS2 (FreeBSD-derived), not FAT. The mount must handle UFS2 on top of decryption.

2. Get your key (mandatory, whichever route)

Every tool needs your eid_root_key (ERK, 32 bytes / 64 hex) — or the ATA data+tweak keys directly:

  • Dump the ERK on the console: via Rebug Toolbox (Dump EID Root Key) or BadWDSD. On an arcade board the key is static but you dump it the same way.
  • ⚠️ We don't host keys. You extract yours from your board.
Tool Type What it does
PS3HddTool (Pheeeeenom) GUI .NET 8 / Avalonia (Win/macOS/Linux) decrypts XTS-AES-128 with the EID Root Key, browses UFS2, extracts files/folders (image or physical drive)
PS-HDD-Tools (aerosoul94) CLI takes an HDD image + key file → outputs a decrypted partition
PS3 HDD Decryption Helper (2023, PSX-Place) bash scripts automates decryption + read/write UFS2 mount; compiles the bswap16-ecb module itself (fixed for recent kernels Nov 2023); drop eid_root_key.bin in /keys
  • To just read/extract: PS3HddTool (GUI, simple, no compilation).
  • To edit in place then write back: the Decryption Helper (mounts UFS2 read-write) — that's the one for your need.
  • Build PS3HddTool: dotnet build (or dotnet publish -r linux-x64 --self-contained) — .NET 8 required.

Tools archived WITH US (sources disappear)

The original dm-bswap16 repo (gitorious) shut down → we archive the open-source sources in the wiki repo (no firmware/key/patch):

The Decryption Helper (scripts + restored bswap16-ecb source) is on PSX-Place (forum) → not auto-archivable, link in the README.

4. Manual dm-crypt route (to understand what the Helper does)

⚠️ You must compile a kernel module: bswap16 (a.k.a. bswap16-ecb) is not in the standard kernel. The original repo (gitorious.ps3dev.net) is dead; the source is restored and compiled by the Decryption Helper (script in /tmp). Without it, HDD decryption won't work. The TOOL route above saves you this work.

# Kernel/tool prerequisites
modprobe loop dm_mod dm-bswap16
# (dm-bswap16: module that swaps bytes per 16-bit word — MANDATORY for PS3
#  HDD/VFLASH decryption)

# 1) Working image (COPY) of the HDD
dd if=/dev/sdX of=hdd.img bs=4M            # sdX = your arcade HDD on SATA/USB
losetup /dev/loop1 ./hdd.img

# 2) bswap16 layer
SIZE=$(blockdev --getsz /dev/loop1)
echo "0 $SIZE bswap16 /dev/loop1" | dmsetup create ps3raw

# 3) Key file = data key (hex) + tweak key (hex) → 32 bytes
echo <DATA_KEY_HEX> <TWEAK_KEY_HEX> | xxd -r -p > hdd_key.bin

# 4) dm-crypt XTS-AES-128 layer (Slim/NOR: 357C/369)
#    -s 256 because XTS-AES-128 = data(128) + tweak(128) concatenated
cryptsetup create -c aes-xts-plain64 -d ./hdd_key.bin -s 256 hdd_crypt /dev/mapper/ps3raw
# → /dev/mapper/hdd_crypt = DECRYPTED HDD

# (357A/B = Phat: HDD in AES-CBC-192 → -c aes-cbc-plain -s 192, no tweak)
For VFLASH (double layer, starts at sector 8): 
echo "0 8 linear /dev/mapper/hdd_crypt 8" | dmsetup create vflash
echo <ENCDEC_DATA_HEX> <ENCDEC_TWEAK_HEX> | xxd -r -p > vflash_key.bin
cryptsetup create -c aes-xts-plain64 -d ./vflash_key.bin -s 256 -p 8 vflash_crypt /dev/mapper/vflash

5. Partition table & mounting

The PS3 partition table is specific (big-endian) → use a PS3-patched kpartx (or the helper's tool) to expose the decrypted HDD's partitions: 

kpartx -av /dev/mapper/hdd_crypt          # creates /dev/mapper/hdd_cryptP1, P2...
mkdir -p /mnt/hdd0
# dev_hdd0 = UFS2 (FreeBSD) → type ufs / ufstype=ufs2
mount -t ufs -o ufstype=ufs2,rw /dev/mapper/hdd_cryptP<N> /mnt/hdd0
ls /mnt/hdd0/game/                         # ← game content, editable

6. Edit then close cleanly

  1. Edit files under /mnt/hdd0/... (game scripts, dev_hdd0/game/…).
  2. Unmount in reverse order: 
    umount /mnt/hdd0
kpartx -d /dev/mapper/hdd_crypt
cryptsetup remove vflash_crypt; dmsetup remove vflash
cryptsetup remove hdd_crypt; dmsetup remove ps3raw
losetup -d /dev/loop1
  3. Re-encryption is transparent (dm-crypt writes encrypted on the fly) — your modified hdd.img is already re-encrypted. Write it back: dd if=hdd.img of=/dev/sdX bs=4M.

Limits & checks

  • Signatures/hashes: some games verify file integrity → editing without re-signing may prevent boot. Test benign changes first.

  • The right key model: 357A/B (Phat, AES-CBC) ≠ 357C/369 (Slim, XTS) — use the right cipher, else unreadable data.

  • Back up the image before any write.

Where to read more (Linux HDD)

Converting a retail PS3 motherboard to replace a dead board

Principle: an arcade motherboard is a retail PS3 board whose Product Code is set to ARC (0xA0); that's what enables arcade HDD decryption. So you can turn a retail PS3 donor into a replacement motherboard.

Prerequisites

  • A PS3 donor of the RIGHT motherboard model:
  • 357A → COK-002 (Fat, NAND)
  • 357B → VER-001 (Fat, NOR)
  • 357C / 369 → JTP-001 (Slim, NOR) — e.g. a CECH-2501A has a JTP-001.
  • The donor must be CFW-capable: all Fats are; only certain Slims; HEN-only Slims/Super-Slims do not work (incompatible for this conversion).
  • GEX firmware: 4.70 GEX CFW, or GEX OFW 3.60-3.70 (most games run on these firmwares).
  • You must keep: your dongle, your game HDD, and the I/O + JVS boards (or the USB I/O PCB) — without them, no game boots.

Arcade vs retail board differences (to know)

Arcade motherboards are depopulated retail boards: no WiFi/BT module soldered, none of the chips/clips tied to the Blu-ray drive. Conversely, from a retail donor you can reuse the AV port to repair an arcade board (cited to fix a 369).

What is "the Product Code"?

It's a console type/region identifier, a byte stored in the IDPS (5th/6th byte, present in EID0 and EID5, in the PerConsole flash region NOR/NAND):

Code Type Model
0x82 DEX (Debug) DECH-…
0x83 CEX (Retail Japan) CECH…
0x84 / 0x85 Retail USA / Europe CECH…01 / …04
0xA0 ARC (Arcade) GECR-xx00

Converting a donor = changing this byte to 0xA0 (ARC) in the flash. That's what lets lv1ldr decrypt the arcade HDD (static key).

Detailed procedure (documented level)

You must work on the flash (NOR/NAND) of the console → hardware flash it (clip + E3 Flasher / Teensy++ / progskeet), or dump/reflash via a software exploit if the console is already on CFW/HEN.

  1. Pick a donor of the right model (COK-002 NAND / VER-001 NOR / JTP-001 NOR), CFW-capable.
  2. Dump the flash (NOR or NAND depending on model) — hardware flasher or software on CFW/HEN.
  3. Patch the dump with c2d.exe. Concretely, c2d.exe recomputes the flash's EID0 identity region: it sets the Product Code to ARC (0xA0) and re-encrypts/re-signs EID0 with your eid_root_key so the console accepts this new EID0. (That's why you need the key + OpenSSL.) There's no other "magic patch" on the flash side: the GEX firmware's only other requirement is a USB authentication at boot — see the box below.

⚠️ These edits differ by the console's flash memory TYPE: NOR (357B/C, 369) or NAND (357A). The flash format is not the same → use the matching patch set (NOR patches on a NOR console, NAND on a NAND). Mixing them = brick.

Exact command (c2d.exe) — changes the dump's Product Code (Target ID): 

:: syntax: c2d.exe <eid_key.bin> <flash_in.bin> <flash_out.bin> [target_id]
c2d.exe eid_root_key.bin flash_dump.bin flash_arcade.bin A0
:: A0 = ARC (arcade).  (ref: 82=DEX, 83=JP, 84=USA, 85=EU, 86=KR, 87=UK...)

  • eid_root_key.bin = the EID (per-console) key extracted from the NOR/NAND dump.

  • Prerequisite: OpenSSL 1.0.1 installed in c:\openssl (or d:\openssl).

  • On NOR: rename the output to XXXXX.EID0.NORBIN and put it on USB to reflash.

ℹ️ c2d.exe is originally the CEX↔DEX / region-change tool; A0 (arcade) support depends on the build you use — check yours accepts A0. (Download: Wololo / PSX-Place.) 4. Flash the patched EID0 (documented route): rename the output to XXXXX.EID0.NORBIN, put it on USB, flash it via mmOS (click the dump → flash EID0), then reboot into recovery mode. 5. Install the GEX firmware (the arcade firmware: OFW GEX 3.60-3.70, or CFW GEX 4.70) — from recovery mode, like a firmware install. GEX firmwares are archived (e.g. Internet Archive ps3-arcade-gex). 6. Get/keep the eid_root_key (dump via Rebug Toolbox) — useful on the PC side for the HDD (see the Linux HDD section). 7. Reconnect I/O + JVS + dongle + game HDD. 8. Boot: the arcade game runs. (The board no longer reads normal PS3 games or discs: Blu-ray and WiFi disabled by the arcade firmware.)

The extra thing the GEX firmware requires: USB authentication

Beyond EID0 (Product Code A0), the GEX firmware checks a "USB authentication" at boot: it expects the I/O + JVS boards and the dongle on USB. Without them, the documented symptom is a ~1 min black screen then "an error occurred during the start operation." Two ways out:

  • Connect the real hardware (I/O + JVS + dongle + HDD) → the full cabinet boots normally. This is the preservation/repair route (what you want when replacing a dead motherboard).

  • Going without the Namco hardware (play without I/O + dongle): you must bypass the USB auth — i.e. firmware patches (MFW) + I/O/JVS + dongle emulation. This is NOT a clean, downloadable solution: it's an ongoing research topic in the scene. Bits float around forums (grey area, dubious reliability), but nothing stable/documented publicly. We don't host this content.

  • The "software" alternative: RPCS3 emulation (already works for some games). RPCS3 runs these titles from a decrypted HDD dump (the dev_hdd0/game/… folder + the EBOOT) — no key required, the games boot like PS3 games. The only blocker is the dongle/I-O check (error 19-1: the game looks for hardware in dev_usb). The scene has produced RPCS3 patches (patch.yml) that NOP out the dongle check per game (+ mapping for special controllers like Taiko drums). With the right patch, a game boots without a dongle (confirmed by users). Apply them via RPCS3's patch manager, on your dump.

Real level: hardware flashing + CFW

This conversion is not a one-click software thing: it requires dumping and reflashing the NOR/NAND (skill + a hardware flasher), patching the identity (c2d.exe) and installing a GEX firmware. It's advanced, for those who know PS3 modding. We host neither the patches nor the firmwares — we describe the method and tools.

The trap: cooling

On a conversion, the fan speeds stay at retail values (slower than a 357C/369). In prolonged arcade use, the board overheats and risks an early death. The 357A/B have a wire removed on the fan connector (forced speed) — replicate that on the target. Plan extra cooling for 24/7 use.

When it makes sense (and when not)

  • ✅ Yes: repair/replace a dead motherboard for home/preservation use, with your original HDD + dongle.
  • ⚠️ Caution: for heavy arcade use, the cooling issue is not trivial (overheating). Still a young, imperfect method.

Before / after

  • Dead motherboard replaced: the 357/369 cabinet lives again with a PS3 donor of the right model, your original dongle + HDD.

Where to read more

Sources & attribution

  • PS3 Developer Wiki — Namco System 357 (Product Code ARC 0xA0, HDD key in lv1ldr, COK-002/VER-001/JTP-001, I/O+JVS, US1001/USIO01, game/HDD/dongle table) — https://www.psdevwiki.com/ps3/Namco_System_357
  • Arcade-Projects — retail→arcade conversion (motherboard models, GEX CFW 4.70 / OFW 3.60-3.70, I/O+dongle+HDD prerequisites, cooling) — https://www.arcade-projects.com/
  • Wikipedia / Arcade Otaku — Namco System 357/369.

Review & corrections

How this space is used

Spotted a wrong value, an outdated procedure, a chip reference that does not match your board? Say so here, with what you observed (model, board revision, serial number, measurement). Every report is cross-checked against a source before anything changes — an unverifiable correction is published as “reported by …, not cross-checked” rather than silently applied.

Reading is open to everyone; posting requires signing in with Discord. Reports from the wiki's declared reviewers are handled first; anyone else's are read too, but go through a human before anything is changed.