Bonk HEN 14.00 disc image
A 6.2 MB Blu-ray disc image that starts a BD-J applet on a PlayStation 4 running firmware 14.00 and applies HEN from the disc. No network, no USB stick, no second console. Everything needed to write the disc and read what it prints is documented here.
Read this before you burn anything. This is a research project. Applying kernel patches to a console is done at your own risk and that risk is yours to carry, including the possibility of a panic, data loss, a voided warranty, or a PlayStation Network ban. I ran this disc on my own PS4 at 14.00 and it worked start to finish: preflight passed, one press of X, HEN applied. Your burner, your disc brand and your console revision are not mine, so the outcome stays yours to confirm.
Downloads
Check the SHA-256 of whatever you download before you burn it. The on-disc preflight hashes the payload itself and stops on a mismatch, so one wrong bit means the disc does nothing.
| File | Size | SHA-256 |
|---|---|---|
| hen.iso canonical image |
6,225,920 | 39da48ea6711795850d3062b4ba85a650d4b6289e6682350843db8e0f0d141c3 |
| hen-branded.iso same disc, updated credit line |
6,225,920 | 1f4c7738fab330ed49941a468052b5e69d8aaaff7c58061446a97bdfec430dd2 |
| 00000.jar the signed BD-J payload, for inspection |
192,403 | d6b16769366df24d50623afdaefab6b2299ff02bb816ea30da7839a572b3c0ed |
The two images hold the same exploit. reports/BRAND_REPORT.json lists the 469 bytes that differ, all of them inside the 564-byte NOTICE.txt text extent at sector 448. UDF metadata, the signed JAR and the other 37 file extents are byte-identical between them. SHA256SUMS.txt covers every file on this site.
How the disc works
BDMV/BDJO/00000.bdjo registers org.bdj.InitXlet as an auto-run applet, so the code starts when the player opens the disc. The Xlet then checks its own assets against SHA-256 pins compiled into it: four helper classes, forty command templates, seven metadata files and the 562,240-byte native stage bonk/hen.bin. That is twenty-five checks. It prints LOCAL PREFLIGHT PASS. Press X once to run. and waits.
One press of X hands control to a result-gated interpreter. Each command template is re-hashed and its shape re-checked at render time, and the next step runs only when the previous step reported the expected result. The final stage is Hx1400, which maps hen.bin into the kernel. There is no retry loop anywhere in that chain, which is why one boot buys one attempt.
The verification page shows how to confirm all of that with public tools, and technical notes carry the full layout table.
What you need
| Item | Requirement |
|---|---|
| Console | Retail PS4, any model, firmware exactly 14.00. The kernel stage is version-specific. |
| Media | BD-R or BD-RE. Capacity is irrelevant at 5.94 MiB; write quality is not. |
| Burner | Anything your OS sees. Slowest supported speed, verify after write, close the session. |
| Controller | A DualShock 4. The disc needs one button press. |
| Backup | Saves copied to USB or cloud before the first run. |
Five steps
- Read Safety. The one-attempt-per-boot rule is enforced by the disc itself and a failed run can still write kernel memory.
- Verify the download against the hash above.
- Write the image raw to a BD-R at the slowest speed and finalize it. Step 5 of the tutorial covers ImgBurn, AnyBurn, growisofs and hdiutil.
- Insert the disc on a console that is fully powered off and on 14.00, let it auto-play, press X once when the preflight passes.
- Confirm the result independently. The disc prints
Hx reports HEN start. Verify menu and kernel R/W separately.and means it.
What this release does not include
No source code, build scripts, manifests or bytecode sources are published. The native stage ships as a signed, pinned asset with no source. The UDF authoring method is not reproducible from public tooling, so treat the ISO as a finished artifact. Security notes describe the remote-control code that exists inside the image and the four measurements showing it has no reachable call path in this build.
Credits
MortySmithir built this reconstruction, the verification suite and the documentation. Kat (@avieah), Slopp (@slopp) and Pigeon (@daburningpigeon) are credited by name on the disc, and that line is preserved in both images.
PlayStation and PS4 are trademarks of Sony Interactive Entertainment. This project is independent and is not affiliated with or endorsed by them. It carries no protected content and circumvents no content protection.