diff --git a/SUMMARY.md b/SUMMARY.md
index c7626ae..37a5fa7 100644
--- a/SUMMARY.md
+++ b/SUMMARY.md
@@ -41,42 +41,51 @@ GitHub 地址：https://github.com/firmianay/CTF-All-In-One
     * [1.7.3 ARM 汇编基础](doc/1.7.3_arm.md)
     * [1.7.4 Android 常用工具](doc/1.7.4_android_tools.md)
 * [二、工具篇](doc/2_tools.md)
-  * [2.1 VM](doc/2.1_vm.md)
-    * [2.1.1 QEMU](doc/2.1.1_qemu.md)
-  * [2.2 gdb/peda](doc/2.2_gdb.md)
-  * [2.3 ollydbg](doc/2.3_ollydbg.md)
-  * [2.4 windbg](doc/2.4_windbg.md)
-  * [2.5 radare2](doc/2.5_radare2.md)
-  * [2.6 IDA Pro](doc/2.6_idapro.md)
-  * [2.7 pwntools](doc/2.7_pwntools.md)
-  * [2.8 zio](doc/2.8_zio.md)
-  * [2.9 JEB](doc/2.9_jeb.md)
-  * [2.10 metasploit](doc/2.10_metasploit.md)
-  * [2.11 binwalk](doc/2.11_binwalk.md)
-  * [2.12 Burp Suite](doc/2.12_burpsuite.md)
-  * [2.13 LLDB](doc/2.13_lldb.md)
+  * 虚拟化分析环境
+    * [2.1.1 VirtualBox](doc/2.1.1_virtualbox.md)
+    * [2.1.2 QEMU](doc/2.1.2_qemu.md)
+    * [2.1.3 Docker](doc/2.1.3_docker.md)
+    * [2.1.4 Unicorn](doc/2.1.4_unicorn.md)
+  * 静态分析工具
+    * [2.2.1 radare2](doc/2.2.1_radare2.md)
+    * [2.2.2 IDA Pro](doc/2.2.2_idapro.md)
+    * [2.2.3 JEB](doc/2.2.3_jeb.md)
+    * [2.2.4 Capstone](doc/2.2.4_capstone.md)
+    * [2.2.5 Keystone](doc/2.2.5_keystone.md)
+  * 动态分析工具
+    * [2.3.1 GDB](doc/2.3.1_gdb.md)
+    * [2.3.2 OllyDbg](doc/2.3.2_ollydbg.md)
+    * [2.3.3 x64dbg](doc/2.3.3_x64dbg.md)
+    * [2.3.4 WinDbg](doc/2.3.4_windbg.md)
+    * [2.3.5 LLDB](doc/2.3.5_lldb.md)
+  * 其他工具
+    * [2.4.1 pwntools](doc/2.4.1_pwntools.md)
+    * [2.4.2 zio](doc/2.4.2_zio.md)
+    * [2.4.3 metasploit](doc/2.4.3_metasploit.md)
+    * [2.4.4 binwalk](doc/2.4.4_binwalk.md)
+    * [2.4.5 Burp Suite](doc/2.4.5_burpsuite.md)
+    * [2.4.6 Wireshark](doc/2.4.6_wireshark.md)
 * [三、分类专题篇](doc/3_topics.md)
-  * [3.1 Reverse](doc/3.1_reverse.md)
-  * [3.2 Crypto](doc/3.2_crypto.md)
-    * [3.2.1 古典密码](doc/3.2.1_classic_crypto.md)
-  * [3.3 Pwn](doc/3.3_pwn.md)
-    * [3.3.1 格式化字符串漏洞](doc/3.3.1_format_string.md)
-    * [3.3.2 整数溢出](doc/3.3.2_integer_overflow.md)
-    * [3.3.3 栈溢出](doc/3.3.3_stack_overflow.md)
-    * [3.3.4 返回导向编程（ROP）（x86）](doc/3.3.4_rop_x86.md)
-    * [3.3.5 返回导向编程（ROP）（ARM）](doc/3.3.5_rop_arm.md)
-    * [3.3.6 Linux 堆利用（上）](doc/3.3.6_heap_exploit_1.md)
-    * [3.3.7 Linux 堆利用（中）](doc/3.3.7_heap_exploit_2.md)
-    * [3.3.8 Linux 堆利用（下）](doc/3.3.8_heap_exploit_3.md)
-    * [3.3.9 内核 ROP](doc/3.3.9_kernel_rop.md)
-    * [3.3.10 Linux 内核漏洞利用](doc/3.3.10_linux_kernel_exploit.md)
-    * [3.3.11 Windows 内核漏洞利用](doc/3.3.11_windows_kernel_exploit.md)
-    * [3.3.12 竞争条件](doc/3.3.12_race_condition.md)
-  * [3.4 Web](doc/3.4_web.md)
-    * [3.4.1 SQL 注入利用](doc/3.4.1_sql_injection.md)
-    * [3.4.2 XSS 漏洞利用](doc/3.4.2_xss.md)
-  * [3.5 Misc](doc/3.5_misc.md)
-  * [3.6 Mobile](doc/3.6_mobile.md)
+  * Pwn
+    * [3.1.1 格式化字符串漏洞](doc/3.1.1_format_string.md)
+    * [3.1.2 整数溢出](doc/3.1.2_integer_overflow.md)
+    * [3.1.3 栈溢出](doc/3.1.3_stack_overflow.md)
+    * [3.1.4 返回导向编程（ROP）（x86）](doc/3.1.4_rop_x86.md)
+    * [3.1.5 返回导向编程（ROP）（ARM）](doc/3.1.5_rop_arm.md)
+    * [3.1.6 Linux 堆利用（上）](doc/3.1.6_heap_exploit_1.md)
+    * [3.1.7 Linux 堆利用（中）](doc/3.1.7_heap_exploit_2.md)
+    * [3.1.8 Linux 堆利用（下）](doc/3.1.8_heap_exploit_3.md)
+    * [3.1.9 内核 ROP](doc/3.1.9_kernel_rop.md)
+    * [3.1.10 Linux 内核漏洞利用](doc/3.1.10_linux_kernel_exploit.md)
+    * [3.1.11 Windows 内核漏洞利用](doc/3.1.11_windows_kernel_exploit.md)
+    * [3.1.12 竞争条件](doc/3.1.12_race_condition.md)
+  * Reverse
+  * Web
+    * [3.3.1 SQL 注入利用](doc/3.3.1_sql_injection.md)
+    * [3.3.2 XSS 漏洞利用](doc/3.3.2_xss.md)
+  * Crypto
+  * Misc
+  * Mobile
 * [四、技巧篇](doc/4_tips.md)
   * [4.1 Linux 内核调试](doc/4.1_linux_kernel_debug.md)
   * [4.2 Linux 命令行技巧](doc/4.2_Linux_terminal_tips.md)
@@ -113,16 +122,15 @@ GitHub 地址：https://github.com/firmianay/CTF-All-In-One
     * [5.5.1 动态污点分析](doc/5.5.1_dyn_taint_analysis.md)
   * [5.6 LLVM](doc/5.6_llvm.md)
     * [5.6.1 Clang](doc/5.6.1_clang.md)
-  * [5.7 Capstone/Keystone](doc/5.7_cap-keystone.md)
+  * [5.7 程序切片](doc/5.7_slicing.md)
   * [5.8 SAT/SMT](doc/5.8_sat-smt.md)
     * [5.8.1 Z3](doc/5.8.1_z3.md)
   * [5.9 基于模式的漏洞分析](doc/5.9_pattern_based_detection.md)
   * [5.10 基于二进制比对的漏洞分析](doc/5.10_diff_based_detection.md)
   * [5.11 反编译技术](doc/5.11_decompiling.md)
     * [5.11.1 RetDec](doc/5.11.1_retdec.md)
-  * [5.12 Unicorn 模拟器](doc/5.12_unicorn.md)
 * [六、题解篇](doc/6_writeup.md)
-  * pwn
+  * Pwn
     * [6.1.1 pwn HCTF2016 brop](doc/6.1.1_pwn_hctf2016_brop.md)
     * [6.1.2 pwn NJCTF2017 pingme](doc/6.1.2_pwn_njctf2017_pingme.md)
     * [6.1.3 pwn XDCTF2015 pwn200](doc/6.1.3_pwn_xdctf2015_pwn200.md)
@@ -143,15 +151,18 @@ GitHub 地址：https://github.com/firmianay/CTF-All-In-One
     * [6.1.18 pwn HITBCTF2017 Sentosa](doc/6.1.18_pwn_hitbctf2017_sentosa.md)
     * [6.1.19 pwn HITBCTF2018 gundam](doc/6.1.19_pwn_hitbctf2018_gundam.md)
     * [6.1.20 pwn 33C3CTF2016 babyfengshui](doc/6.1.20_pwn_33c3ctf2016_babyfengshui.md)
-  * re
+  * Reverse
     * [6.2.1 re XHPCTF2017 dont_panic](doc/6.2.1_re_xhpctf2017_dont_panic.md)
     * [6.2.2 re ECTF2016 tayy](doc/6.2.2_re_ectf2016_tayy.md)
     * [6.2.3 re Codegate2017 angrybird](doc/6.2.3_re_codegate2017_angrybird.md)
     * [6.2.4 re CSAWCTF2015 wyvern](doc/6.2.4_re_csawctf2015_wyvern.md)
     * [6.2.5 re PicoCTF2014 Baleful](doc/6.2.5_re_picoctf2014_baleful.md)
     * [6.2.6 re SECCON2017 printf_machine](doc/6.2.6_re_seccon2017_printf_machine.md)
-  * web
+  * Web
     * [6.3.1 web HCTF2017 babycrack](doc/6.3.1_web_hctf2017_babycrack.md)
+  * Crypto
+  * Misc
+  * Mobile
 * [七、实战篇](doc/7_exploit.md)
   * CVE
     * [7.1.1 [CVE-2017-11543] tcpdump 4.9.0 Buffer Overflow](doc/7.1.1_tcpdump_2017-11543.md)
@@ -162,7 +173,6 @@ GitHub 地址：https://github.com/firmianay/CTF-All-In-One
     * [7.1.6 [CVE-2017-9430] DNSTracer 1.9 Buffer Overflow](doc/7.1.6_dnstracer_2017-9430.md)
     * [7.1.7 [CVE-2018-6323] GNU binutils 2.26.1 Integer Overflow](doc/7.1.7_binutils_2018-6323.md)
   * Malware
-    * 7.2.x
 * [八、学术篇](doc/8_academic.md)
   * [8.1 The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86)](doc/8.1_ret2libc_without_func_calls.md)
   * [8.2 Return-Oriented Programming without Returns](doc/8.2_rop_without_returns.md)
@@ -192,5 +202,5 @@ GitHub 地址：https://github.com/firmianay/CTF-All-In-One
   * [9.1 更多 Linux 工具](doc/9.1_Linuxtools.md)
   * [9.2 更多 Windows 工具](doc/9.2_wintools.md)
   * [9.3 更多资源](doc/9.3_books_blogs.md)
-  * [9.4 Linux x86-64 系统调用表](doc/9.4_linux_syscall.md)
+  * [9.4 Linux 系统调用表](doc/9.4_linux_syscall.md)
   * [9.5 幻灯片](doc/9.5_slides.md)
diff --git a/doc/1.1.5_rop_arm.md b/doc/1.1.5_rop_arm.md
new file mode 100644
index 0000000..e69de29
diff --git a/doc/1.5.7_memory.md b/doc/1.5.7_memory.md
index 96f2eaa..1e85afc 100644
--- a/doc/1.5.7_memory.md
+++ b/doc/1.5.7_memory.md
@@ -65,7 +65,7 @@ RET             ; 函数返回并跳转
 
 ![](../pic/1.5.7_stack.png)
 
-我们来看一个例子：[源码](../src/Others/1.5.7_memory/stack.c)
+我们来看一个例子：[源码](../src/others/1.5.7_memory/stack.c)
 ```c
 #include<stdio.h>
 int add(int a, int b) {
@@ -208,7 +208,7 @@ void *sbrk(intptr_t increment);
 
 在上图中我们看到 brk 指示堆结束地址，start_brk 指示堆开始地址。BSS segment 和 heap 之间有一段 Random brk offset，这是由于 ASLR 的作用，如果关闭了 ASLR，则 Random brk offset 为 0，堆结束地址和数据段开始地址重合。
 
-例子：[源码](../src/Others/1.5.7_memory/brk.c)
+例子：[源码](../src/others/1.5.7_memory/brk.c)
 ```C
 #include <stdio.h>
 #include <unistd.h>
@@ -347,7 +347,7 @@ void *mmap(void *addr, size_t len, int prot, int flags,
 int munmap(void *addr, size_t len);
 ```
 
-例子：[源码](../src/Others/1.5.7_memory/mmap.c)
+例子：[源码](../src/others/1.5.7_memory/mmap.c)
 ```C
 #include <stdio.h>
 #include <sys/mman.h>
diff --git a/doc/1.5.8_glibc_malloc.md b/doc/1.5.8_glibc_malloc.md
index 759361b..230c7d3 100644
--- a/doc/1.5.8_glibc_malloc.md
+++ b/doc/1.5.8_glibc_malloc.md
@@ -5,7 +5,7 @@
 - [参考资料](#参考资料)
 
 
-[下载文件](../src/Others/1.5.8_glibc_malloc)
+[下载文件](../src/others/1.5.8_glibc_malloc)
 
 ## glibc
 glibc 即 GNU C Library，是为 GNU 操作系统开发的一个 C 标准库。glibc 主要由两部分组成，一部分是头文件，位于 `/usr/include`；另一部分是库的二进制文件。二进制文件部分主要是 C 语言标准库，有动态和静态两个版本，动态版本位于 `/lib/libc.so.6`，静态版本位于 `/usr/lib/libc.a`。
diff --git a/doc/1.5.9_linux_kernel.md b/doc/1.5.9_linux_kernel.md
index 5a5c507..2b96a9b 100644
--- a/doc/1.5.9_linux_kernel.md
+++ b/doc/1.5.9_linux_kernel.md
@@ -76,7 +76,7 @@ $ make
 ## 系统调用
 在 Linux 中，系统调用是一些内核空间函数，是用户空间访问内核的唯一手段。这些函数与 CPU 架构有关，x86-64 架构提供了 322 个系统调用，x86 提供了 358 个系统调用（参考附录9.4）。
 
-下面是一个用 32 位汇编写的例子：
+下面是一个用 32 位汇编写的例子，[源码](../src/others/1.5.9_linux_kernel)：
 ```
 .data
 
diff --git a/doc/1_basic.md b/doc/1_basic.md
index 1ce7e81..fe9294f 100644
--- a/doc/1_basic.md
+++ b/doc/1_basic.md
@@ -1,36 +1,36 @@
 # 第一章 基础知识篇
 
-- [1.1 CTF 简介](1.1_ctf.md)
-- [1.2 学习方法](1.2_how_to_learn.md)
-- [1.3 Linux 基础](1.3_linux_basic.md)
-- [1.4 Web 安全基础](1.4_web_basic.md)
-  - [1.4.1 HTML 基础](1.4.1_html_basic.md)
-  - [1.4.2 HTTP 协议基础](1.4.2_http_basic.md)
-  - [1.4.3 JavaScript 基础](1.4.3_javascript_basic.md)
-  - [1.4.4 常见 Web 服务器基础](1.4.4_webserver_basic.md)
-  - [1.4.5 OWASP Top Ten Project 漏洞基础](1.4.5_owasp_basic.md)
-  - [1.4.6 PHP 源码审计基础](1.4.6_php_basic.md)
-- [1.5 逆向工程基础](1.5_reverse_basic.md)
-  - [1.5.1 C 语言基础](1.5.1_c_basic.md)
-  - [1.5.2 x86/x86-64 汇编基础](1.5.2_x86&x64.md)
-  - [1.5.3 Linux ELF](1.5.3_elf.md)
-  - [1.5.4 Windows PE](1.5.4_pe.md)
-  - [1.5.5 静态链接](1.5.5_static_link.md)
-  - [1.5.6 动态链接](1.5.6_dynamic_link.md)
-  - [1.5.7 内存管理](1.5.7_memory.md)
-  - [1.5.8 glibc malloc](1.5.8_glibc_malloc.md)
-  - [1.5.9 Linux 内核](1.5.9_linux_kernel.md)
-  - [1.5.10 Windows 内核](1.5.10_windows_kernel.md)
-- [1.6 密码学基础](1.6_crypto_basic.md)
-    - [1.6.1 初等数论](1.6.1_number_theory.md)
-    - [1.6.2 近世代数](1.6.2_modern_algebra.md)
-    - [1.6.3 流密码](1.6.3_stream_cipher.md)
-    - [1.6.4 分组密码](1.6.4_block_cipher.md)
-    - [1.6.5 公钥密码](1.6.5_public-key_crypto.md)
-    - [1.6.6 哈希函数](1.6.6_hash.md)
-    - [1.6.7 数字签名](1.6.7_digital_signature.md)
-- [1.7 Android 安全基础](1.7_android_basic.md)
-  - [1.7.1 Android 环境搭建](1.7.1_android_env.md)
-  - [1.7.2 Dalvik 指令集](1.7.2_dalvik.md)
-  - [1.7.3 ARM 汇编基础](1.7.3_arm.md)
-  - [1.7.4 Android 常用工具](1.7.4_android_tools.md)
+* [1.1 CTF 简介](1.1_ctf.md)
+* [1.2 学习方法](1.2_how_to_learn.md)
+* [1.3 Linux 基础](1.3_linux_basic.md)
+* [1.4 Web 安全基础](1.4_web_basic.md)
+  * [1.4.1 HTML 基础](1.4.1_html_basic.md)
+  * [1.4.2 HTTP 协议基础](1.4.2_http_basic.md)
+  * [1.4.3 JavaScript 基础](1.4.3_javascript_basic.md)
+  * [1.4.4 常见 Web 服务器基础](1.4.4_webserver_basic.md)
+  * [1.4.5 OWASP Top Ten Project 漏洞基础](1.4.5_owasp_basic.md)
+  * [1.4.6 PHP 源码审计基础](1.4.6_php_basic.md)
+* [1.5 逆向工程基础](1.5_reverse_basic.md)
+  * [1.5.1 C 语言基础](1.5.1_c_basic.md)
+  * [1.5.2 x86/x86-64 汇编基础](1.5.2_x86&x64.md)
+  * [1.5.3 Linux ELF](1.5.3_elf.md)
+  * [1.5.4 Windows PE](1.5.4_pe.md)
+  * [1.5.5 静态链接](1.5.5_static_link.md)
+  * [1.5.6 动态链接](1.5.6_dynamic_link.md)
+  * [1.5.7 内存管理](1.5.7_memory.md)
+  * [1.5.8 glibc malloc](1.5.8_glibc_malloc.md)
+  * [1.5.9 Linux 内核](1.5.9_linux_kernel.md)
+  * [1.5.10 Windows 内核](1.5.10_windows_kernel.md)
+* [1.6 密码学基础](1.6_crypto_basic.md)
+  * [1.6.1 初等数论](1.6.1_number_theory.md)
+  * [1.6.2 近世代数](1.6.2_modern_algebra.md)
+  * [1.6.3 流密码](1.6.3_stream_cipher.md)
+  * [1.6.4 分组密码](1.6.4_block_cipher.md)
+  * [1.6.5 公钥密码](1.6.5_public-key_crypto.md)
+  * [1.6.6 哈希函数](1.6.6_hash.md)
+  * [1.6.7 数字签名](1.6.7_digital_signature.md)
+* [1.7 Android 安全基础](1.7_android_basic.md)
+  * [1.7.1 Android 环境搭建](1.7.1_android_env.md)
+  * [1.7.2 Dalvik 指令集](1.7.2_dalvik.md)
+  * [1.7.3 ARM 汇编基础](1.7.3_arm.md)
+  * [1.7.4 Android 常用工具](1.7.4_android_tools.md)
diff --git a/doc/2.1.1_virtualbox.md b/doc/2.1.1_virtualbox.md
new file mode 100644
index 0000000..3a30e42
--- /dev/null
+++ b/doc/2.1.1_virtualbox.md
@@ -0,0 +1,99 @@
+# 2.1.1 VirtualBox
+
+- [虚拟化环境](#虚拟化环境)
+- [硬件虚拟化环境](#硬件虚拟化环境)
+  - [物理机 Manjaro 17.02](#物理机-manjaro-1702)
+  - [Windows 虚拟机](#windows-虚拟机)
+  - [Linux 虚拟机](#linux-虚拟机)
+  - [工具安装脚本](#工具安装脚本)
+
+
+## 虚拟化环境
+虚拟化是资源的抽象化，是单一物理资源的多个逻辑表示，具有兼容性、隔离的优良特性。
+
+在恶意代码和漏洞分析过程中常常需要使用虚拟化技术来进行辅助，这不仅可以保护真实的物理设备环境不被恶意代码攻击，还能够固化保存分析环境以提高工作效率，同时还能够在不影响程序执行流的情况下动态捕获程序内存、CPU 等关键数据。
+
+虚拟化技术根据实现技术的不同可以分为：
+- 软件虚拟化：用纯软件的方法在现有平台上实现对物理资源访问的截获和模拟。如 QEMU。
+- 硬件虚拟化：由硬件平台对特殊指令进行截获和重定向，交由虚拟机监控器（VMM）进行处理，这需要 CPU、主板、BIOS 和软件的支持。如 VMWare、VirtualBox。
+
+虚拟化技术根据是否改动操作系统又可以分为：
+- 半虚拟化：通过修改开源操作系统，将虚拟机特殊指令的被动截获请求转化成客户机操作系统的主动通知以提高性能。如 Xen。
+- 全虚拟化：不需要对操作系统进行改动，提供了完整的包括处理器、内存和外设的虚拟化平台。如 VMWare、VirtualBox、
+
+
+## 硬件虚拟化环境
+用硬件虚拟机的话比较简单，可以自己下载安装。下面是我个人的一些环境配置。
+
+- VirtualBox(https://www.virtualbox.org/)
+- VMware Workstation/Player(https://www.vmware.com/)
+
+#### 物理机 Manjaro 17.02
+Manjaro 17.02 x86-64(https://manjaro.org/) with BlackArch tools.
+```text
+$ uname -a
+Linux firmy-pc 4.9.43-1-MANJARO #1 SMP PREEMPT Sun Aug 13 20:28:47 UTC 2017 x86_64 GNU/Linux
+```
+```text
+yaourt -Rscn:
+
+skanlite cantata kdenlive konversation libreoffice-still thunderbird-kde k3b cups
+
+yaourt -S:
+
+virtualbox tree git ipython ipython2 gdb google-chrome tcpdump vim wireshark-qt edb ssdeep wps-office strace ltrace metasploit python2-pwntools peda oh-my-zsh-git radare2 binwalk burpsuite checksec netcat wxhexeditor
+
+pip3/pip2 install:
+
+r2pipe
+```
+
+#### Windows 虚拟机
+- 32-bit
+  - Windows XP
+  - Windows 7
+- 64-bit
+  - Windows 7
+    ```text
+    7-Zip/WinRAR
+    IDA_Pro_v6.8
+    吾爱破解工具包2.0
+    ```
+  - Windows 10
+
+下载地址：http://www.itellyou.cn/
+
+#### Linux 虚拟机
+- 32-bit/64-bit Ubuntu LTS - https://www.ubuntu.com/download
+  - 14.04
+  - 16.04
+    ```text
+    $ uname -a
+    Linux firmyy-VirtualBox 4.10.0-28-generic #32~16.04.2-Ubuntu SMP Thu Jul 20 10:19:13 UTC 2017 i686 i686 i686 GNU/Linux
+    ```
+    ```text
+    apt-get purge:
+
+    libreoffice-common unity-webapps-common thunderbird totem rhythmbox simple-scan gnome-mahjongg aisleriot gnome-mines cheese transmission-common gnome-orca webbrowser-app gnome-sudoku onboard deja-dup usb-creator-common
+
+    apt-get install:
+
+    git vim tree ipython ipython3 python-pip python3-pip foremost ssdeep zsh
+
+    pip2 install:
+
+    termcolor
+    zio
+
+    other install:
+
+    oh my zsh
+    peda
+    ```
+- Kali Linux - https://www.kali.org/
+- BlackArch - https://blackarch.org/
+- REMnux - https://remnux.org
+
+#### 工具安装脚本
+- ctf-tools - https://github.com/zardus/ctf-tools
+- [pwn_env](../src/others/2.1.1_vm/pwn_env.sh)
diff --git a/doc/2.1.1_qemu.md b/doc/2.1.2_qemu.md
similarity index 98%
rename from doc/2.1.1_qemu.md
rename to doc/2.1.2_qemu.md
index 99b5d46..d3c0b97 100644
--- a/doc/2.1.1_qemu.md
+++ b/doc/2.1.2_qemu.md
@@ -1,4 +1,4 @@
-# 2.1.1 QEMU
+# 2.1.2 QEMU
 
 - [简介](#简介)
 - [安装](#安装)
diff --git a/doc/2.1.3_docker.md b/doc/2.1.3_docker.md
new file mode 100644
index 0000000..eb3de74
--- /dev/null
+++ b/doc/2.1.3_docker.md
@@ -0,0 +1 @@
+# 2.1.3 Docker
diff --git a/doc/5.12_unicorn.md b/doc/2.1.4_unicorn.md
similarity index 87%
rename from doc/5.12_unicorn.md
rename to doc/2.1.4_unicorn.md
index 0dda956..b4da03d 100644
--- a/doc/5.12_unicorn.md
+++ b/doc/2.1.4_unicorn.md
@@ -1,4 +1,4 @@
-# 5.12 Unicorn 模拟器
+# 2.1.4 Unicorn 模拟器
 
 - [参考资料](#参考资料)
 
diff --git a/doc/2.10_metasploit.md b/doc/2.10_metasploit.md
deleted file mode 100644
index 28d4858..0000000
--- a/doc/2.10_metasploit.md
+++ /dev/null
@@ -1 +0,0 @@
-# 2.10 MetaSploit
diff --git a/doc/2.1_vm.md b/doc/2.1_vm.md
deleted file mode 100644
index 95decec..0000000
--- a/doc/2.1_vm.md
+++ /dev/null
@@ -1,84 +0,0 @@
-# 2.1 虚拟机环境
-
-- [物理机 Manjaro 17.02](#物理机-manjaro-1702)
-- [创建一个安全的环境](#创建一个安全的环境)
-- [Windows 虚拟机](#windows-虚拟机)
-- [Linux 虚拟机](#linux-虚拟机)
-
-
-## 物理机 Manjaro 17.02
-Manjaro 17.02 x86-64(https://manjaro.org/) with BlackArch tools.
-```text
-$ uname -a
-Linux firmy-pc 4.9.43-1-MANJARO #1 SMP PREEMPT Sun Aug 13 20:28:47 UTC 2017 x86_64 GNU/Linux
-```
-```text
-yaourt -Rscn:
-
-skanlite cantata kdenlive konversation libreoffice-still thunderbird-kde k3b cups
-
-yaourt -S:
-
-virtualbox tree git ipython ipython2 gdb google-chrome tcpdump vim wireshark-qt edb ssdeep wps-office strace ltrace metasploit python2-pwntools peda oh-my-zsh-git radare2 binwalk burpsuite checksec netcat wxhexeditor
-
-pip3/pip2 install:
-
-r2pipe
-```
-
-
-## 创建一个安全的环境
-- VirtualBox(https://www.virtualbox.org/)
-- VMware Workstation/Player(https://www.vmware.com/)
-- QEMU(https://www.qemu.org/download/)
-
-
-## Windows 虚拟机
-- 32-bit
-  - Windows XP
-  - Windows 7
-- 64-bit
-  - Windows 7
-    ```text
-    7-Zip/WinRAR
-    IDA_Pro_v6.8
-    吾爱破解工具包2.0
-    ```
-  - Windows 10
-
-下载地址：http://www.itellyou.cn/
-
-## Linux 虚拟机
-- 32-bit/64-bit Ubuntu LTS - https://www.ubuntu.com/download
-  - 14.04
-  - 16.04
-    ```text
-    $ uname -a
-    Linux firmyy-VirtualBox 4.10.0-28-generic #32~16.04.2-Ubuntu SMP Thu Jul 20 10:19:13 UTC 2017 i686 i686 i686 GNU/Linux
-    ```
-    ```text
-    apt-get purge:
-
-    libreoffice-common unity-webapps-common thunderbird totem rhythmbox simple-scan gnome-mahjongg aisleriot gnome-mines cheese transmission-common gnome-orca webbrowser-app gnome-sudoku onboard deja-dup usb-creator-common
-
-    apt-get install:
-
-    git vim tree ipython ipython3 python-pip python3-pip foremost ssdeep zsh
-
-    pip2 install:
-
-    termcolor
-    zio
-
-    other install:
-
-    oh my zsh
-    peda
-    ```
-- Kali Linux - https://www.kali.org/
-- BlackArch - https://blackarch.org/
-- REMnux - https://remnux.org
-
-#### 工具安装脚本
-- ctf-tools - https://github.com/zardus/ctf-tools
-- [pwn_env](../src/Others/2.1_vm/pwn_env.sh)
diff --git a/doc/2.5_radare2.md b/doc/2.2.1_radare2.md
similarity index 99%
rename from doc/2.5_radare2.md
rename to doc/2.2.1_radare2.md
index 4de449c..512d66c 100644
--- a/doc/2.5_radare2.md
+++ b/doc/2.2.1_radare2.md
@@ -1,4 +1,4 @@
-# 2.5 Radare2
+# 2.2.1 Radare2
 
 - [简介](#简介)
 - [安装](#安装)
diff --git a/doc/2.6_idapro.md b/doc/2.2.2_idapro.md
similarity index 99%
rename from doc/2.6_idapro.md
rename to doc/2.2.2_idapro.md
index 995b683..ca1d029 100644
--- a/doc/2.6_idapro.md
+++ b/doc/2.2.2_idapro.md
@@ -1,4 +1,4 @@
-# 2.6 IDA Pro
+# 2.2.2 IDA Pro
 
 - [常用插件](#常用插件)
 - [常用脚本](#常用脚本)
diff --git a/doc/2.2.3_jeb.md b/doc/2.2.3_jeb.md
new file mode 100644
index 0000000..66ee9a7
--- /dev/null
+++ b/doc/2.2.3_jeb.md
@@ -0,0 +1 @@
+# 2.2.3 JEB
diff --git a/doc/2.2.4_capstone.md b/doc/2.2.4_capstone.md
new file mode 100644
index 0000000..a7d41a2
--- /dev/null
+++ b/doc/2.2.4_capstone.md
@@ -0,0 +1,17 @@
+# 2.2.4 Capstone
+
+- [简介](#简介)
+- [开发接口](#开发接口)
+- [参考资料](#参考资料)
+
+
+## 简介
+Capstone 是一款开源、轻量级、多平台、多架构的反汇编框架，支持 x86、x86-64、ARM、ARM64、MIPS、PowerPC 等架构，支持 Windows、Linux、macOS 操作系统。
+
+
+## 开发接口
+
+## 参考资料
+- http://www.capstone-engine.org/
+- [BHUSA2014-capstone](https://www.capstone-engine.org/BHUSA2014-capstone.pdf)
+- https://github.com/aquynh/capstone
diff --git a/doc/2.2.5_keystone.md b/doc/2.2.5_keystone.md
new file mode 100644
index 0000000..6f16c80
--- /dev/null
+++ b/doc/2.2.5_keystone.md
@@ -0,0 +1,3 @@
+# 2.2.5 Keystone
+
+http://www.keystone-engine.org/
diff --git a/doc/2.2_gdb.md b/doc/2.3.1_gdb.md
similarity index 99%
rename from doc/2.2_gdb.md
rename to doc/2.3.1_gdb.md
index d43a136..977fdc2 100644
--- a/doc/2.2_gdb.md
+++ b/doc/2.3.1_gdb.md
@@ -1,4 +1,4 @@
-# 2.2 gdb/peda
+# 2.3.1 GDB
 
 - [gdb 的组成架构](#gdb-的组成架构)
 - [gdb 基本工作原理](#gdb-基本工作原理)
@@ -11,7 +11,7 @@
 
 
 ## gdb 的组成架构
-![](../pic/2.2_gdb.png)
+![](../pic/2.3.1_gdb.png)
 
 
 ## gdb 基本工作原理
diff --git a/doc/2.3.2_ollydbg.md b/doc/2.3.2_ollydbg.md
new file mode 100644
index 0000000..cbfad21
--- /dev/null
+++ b/doc/2.3.2_ollydbg.md
@@ -0,0 +1 @@
+# 2.3.2 OllyDbg 调试器
diff --git a/doc/2.3.3_x64dbg.md b/doc/2.3.3_x64dbg.md
new file mode 100644
index 0000000..78556eb
--- /dev/null
+++ b/doc/2.3.3_x64dbg.md
@@ -0,0 +1,3 @@
+# 2.3.3 x64dbg
+
+https://x64dbg.com/#start
diff --git a/doc/2.3.4_windbg.md b/doc/2.3.4_windbg.md
new file mode 100644
index 0000000..46233db
--- /dev/null
+++ b/doc/2.3.4_windbg.md
@@ -0,0 +1 @@
+# 2.3.4 WinDbg
diff --git a/doc/2.13_lldb.md b/doc/2.3.5_lldb.md
similarity index 88%
rename from doc/2.13_lldb.md
rename to doc/2.3.5_lldb.md
index 4c3b48b..f59a557 100644
--- a/doc/2.13_lldb.md
+++ b/doc/2.3.5_lldb.md
@@ -1,4 +1,4 @@
-# 2.13 LLDB
+# 2.3.5 LLDB
 
 - [参考资料](#参考资料)
 
diff --git a/doc/2.3_ollydbg.md b/doc/2.3_ollydbg.md
deleted file mode 100644
index 1f6f0d8..0000000
--- a/doc/2.3_ollydbg.md
+++ /dev/null
@@ -1 +0,0 @@
-# 2.3 OllyDbg 调试器
diff --git a/doc/2.7_pwntools.md b/doc/2.4.1_pwntools.md
similarity index 99%
rename from doc/2.7_pwntools.md
rename to doc/2.4.1_pwntools.md
index a6cf62f..94b1d8f 100644
--- a/doc/2.7_pwntools.md
+++ b/doc/2.4.1_pwntools.md
@@ -1,4 +1,4 @@
-# 2.7 Pwntools
+# 2.4.1 Pwntools
 
 - [安装](#安装)
 - [模块简介](#模块简介)
@@ -40,7 +40,7 @@ $ yaourt -S python2-pwntools
 
 $ yaourt -S python2-pwntools-git
 ```
-但是由于 Arch 没有 PPA 源，如果想要支持更多的体系结构（如 arm, aarch64 等），只能手动编译安装相应的 binutils，使用下面的脚本，注意将变量 `V` 和 `ARCH` 换成你需要的。[binutils](https://ftp.gnu.org/gnu/binutils/)[源码](../src/Others/2.7_pwntools/binutils.sh)
+但是由于 Arch 没有 PPA 源，如果想要支持更多的体系结构（如 arm, aarch64 等），只能手动编译安装相应的 binutils，使用下面的脚本，注意将变量 `V` 和 `ARCH` 换成你需要的。[binutils](https://ftp.gnu.org/gnu/binutils/)[源码](../src/others/2.4.1_pwntools/binutils.sh)
 ```bash
 #!/usr/bin/env bash
 
diff --git a/doc/2.8_zio.md b/doc/2.4.2_zio.md
similarity index 99%
rename from doc/2.8_zio.md
rename to doc/2.4.2_zio.md
index 45c7eee..be1d192 100644
--- a/doc/2.8_zio.md
+++ b/doc/2.4.2_zio.md
@@ -1,4 +1,4 @@
-# 2.8 zio
+# 2.4.2 zio
 
 - [zio 简介](#zio-简介)
 - [安装](#安装)
diff --git a/doc/2.4.3_metasploit.md b/doc/2.4.3_metasploit.md
new file mode 100644
index 0000000..d9f2596
--- /dev/null
+++ b/doc/2.4.3_metasploit.md
@@ -0,0 +1 @@
+# 2.4.3 MetaSploit
diff --git a/doc/2.11_binwalk.md b/doc/2.4.4_binwalk.md
similarity index 99%
rename from doc/2.11_binwalk.md
rename to doc/2.4.4_binwalk.md
index 0b59dba..750710b 100644
--- a/doc/2.11_binwalk.md
+++ b/doc/2.4.4_binwalk.md
@@ -1,4 +1,4 @@
-# 2.11 binwalk
+# 2.4.4 binwalk
 
 - [Binwalk 介绍](#binwalk-介绍)
 - [安装](#安装)
diff --git a/doc/2.12_burpsuite.md b/doc/2.4.5_burpsuite.md
similarity index 93%
rename from doc/2.12_burpsuite.md
rename to doc/2.4.5_burpsuite.md
index 4a4e275..4a24785 100644
--- a/doc/2.12_burpsuite.md
+++ b/doc/2.4.5_burpsuite.md
@@ -1,4 +1,4 @@
-# 2.12 Burp Suite
+# 2.4.5 Burp Suite
 
 - [Burp Suite 介绍](#burpsuite-介绍)
 - [安装](#安装)
@@ -31,14 +31,11 @@ Burp 使用的第一步是实现浏览器到 Burp 的代理，以 Firefox 为例
 #### HTTPS 下的 proxy（老版本 Burp ）
 新版 Burp（1.7.30）已经不需要单独导入证书即可抓包，而老版 Burp Https 协议需要浏览器导入 Burp 证书才可正常抓包，具体操作见参考文档。
 
-![](../pic/2.12_burp_proxy1.png)
-
-![](../pic/2.12_burp_proxy2.png)
-
+![](../pic/2.4.5_proxy1.png)
 
+![](../pic/2.4.5_proxy2.png)
 
 #### intruder
-
 intruder 常用于口令爆破，当然作为支持批量可编程的网页重发器，它还有许多有趣的玩法。
 
 使用步骤：
@@ -51,14 +48,13 @@ intruder 常用于口令爆破，当然作为支持批量可编程的网页重
 6. 在子选项栏 “Options” 中可以添加更加复杂的爆破结果匹配模式
 7. 选择完成后，点击右上角的 “Start attack” 开始爆破
 
-![](../pic/2.12_burp_intruder1.png)
+![](../pic/2.4.5_intruder1.png)
 
-![](../pic/2.12_burp_intruder2.png)
+![](../pic/2.4.5_intruder2.png)
 
-![](../pic/2.12_burp_intruder3.png)
+![](../pic/2.4.5_intruder3.png)
 
 #### repeater
-
 repeater 用于单一报文的重复发包测试，在 proxy 界面报文包只能发送一次，通过右键 “Send to Repeater” 可以在 repeater 界面反复发包测试。
 
 
diff --git a/doc/2.4.6_wireshark.md b/doc/2.4.6_wireshark.md
new file mode 100644
index 0000000..7558b63
--- /dev/null
+++ b/doc/2.4.6_wireshark.md
@@ -0,0 +1 @@
+# 2.4.6 Wireshark
diff --git a/doc/2.4_windbg.md b/doc/2.4_windbg.md
deleted file mode 100644
index dd21d9c..0000000
--- a/doc/2.4_windbg.md
+++ /dev/null
@@ -1 +0,0 @@
-# 2.4 WinDbg 调试器
diff --git a/doc/2.9_jeb.md b/doc/2.9_jeb.md
deleted file mode 100644
index 180d4f0..0000000
--- a/doc/2.9_jeb.md
+++ /dev/null
@@ -1 +0,0 @@
-# 2.9 JEB
diff --git a/doc/2_tools.md b/doc/2_tools.md
index b6485b9..968a039 100644
--- a/doc/2_tools.md
+++ b/doc/2_tools.md
@@ -1,16 +1,26 @@
 # 第二章 工具篇
 
-- [2.1 VM](2.1_vm.md)
-    - [2.1.1 QEMU](2.1.1_qemu.md)
-- [2.2 gdb/peda](2.2_gdb.md)
-- [2.3 ollydbg](2.3_ollydbg.md)
-- [2.4 windbg](2.4_windbg.md)
-- [2.5 radare2](2.5_radare2.md)
-- [2.6 IDA Pro](2.6_idapro.md)
-- [2.7 pwntools](2.7_pwntools.md)
-- [2.8 zio](2.8_zio.md)
-- [2.9 JEB](2.9_jeb.md)
-- [2.10 metasploit](2.10_metasploit.md)
-- [2.11 binwalk](2.11_binwalk.md)
-- [2.12 Burp Suite](2.12_burpsuite.md)
-- [2.13 LLDB](2.13_lldb.md)
+* 虚拟化分析环境
+  * [2.1.1 VirtualBox](doc/2.1.1_virtualbox.md)
+  * [2.1.2 QEMU](doc/2.1.2_qemu.md)
+  * [2.1.3 Docker](doc/2.1.3_docker.md)
+  * [2.1.4 Unicorn](doc/2.1.4_unicorn.md)
+* 静态分析工具
+  * [2.2.1 radare2](2.2.1_radare2.md)
+  * [2.2.2 IDA Pro](2.2.2_idapro.md)
+  * [2.2.3 JEB](2.2.3_jeb.md)
+  * [2.2.4 Capstone](2.2.4_capstone.md)
+  * [2.2.5 Keystone](2.2.5_keystone.md)
+* 动态分析工具
+  * [2.3.1 GDB](2.3.1_gdb.md)
+  * [2.3.2 OllyDbg](2.3.2_ollydbg.md)
+  * [2.3.3 x64dbg](2.3.3_x64dbg.md)
+  * [2.3.4 WinDbg](2.3.4_windbg.md)
+  * [2.3.5 LLDB](2.3.5_lldb.md)
+* 其他工具
+  * [2.4.1 pwntools](2.4.1_pwntools.md)
+  * [2.4.2 zio](2.4.2_zio.md)
+  * [2.4.3 metasploit](2.4.3_metasploit.md)
+  * [2.4.4 binwalk](2.4.4_binwalk.md)
+  * [2.4.5 Burp Suite](2.4.5_burpsuite.md)
+  * [2.4.6 Wireshark](2.4.6_wireshark.md)
diff --git a/doc/3.3.10_linux_kernel_exploit.md b/doc/3.1.10_linux_kernel_exploit.md
similarity index 99%
rename from doc/3.3.10_linux_kernel_exploit.md
rename to doc/3.1.10_linux_kernel_exploit.md
index 6828124..387467b 100644
--- a/doc/3.3.10_linux_kernel_exploit.md
+++ b/doc/3.1.10_linux_kernel_exploit.md
@@ -1,4 +1,4 @@
-# 3.3.10 Linux 内核漏洞利用
+# 3.1.10 Linux 内核漏洞利用
 
 - [从用户态到内核态](#从用户态到内核态)
 - [内核漏洞分类](#内核漏洞分类)
@@ -146,7 +146,7 @@ int copyout(const void *__restrict kaddr, void *__restrict udaddr, size_t len) _
 ```
 第三个参数的类型 `size_t` 是一个无符号整数，所以当 `len` 是一个负数的时候，会被认为是一个很大的正整数，造成任意内核内存读取。
 
-更多内存可以参见章节 3.3.2。
+更多内存可以参见章节 3.1.2。
 
 #### 竞态条件
 如果有两个或两个以上执行者将要执行某一动作并且执行结果会由于它们执行顺序的不同而完全不同时，也就是发生了竞争条件。避免竞争条件的方法有很多，例如通过锁、信号量、条件变量等来保证各种行动者之间的同步性。竞争条件中最重要的一点是可竞争窗口的大小，它对于触发竞态条件的难易至关重要，由于这个原因，一些竞态条件的情况只能在对称多处理器（SMP）中被利用。
diff --git a/doc/3.3.11_windows_kernel_exploit.md b/doc/3.1.11_windows_kernel_exploit.md
similarity index 86%
rename from doc/3.3.11_windows_kernel_exploit.md
rename to doc/3.1.11_windows_kernel_exploit.md
index 6bfe0c6..d39ec96 100644
--- a/doc/3.3.11_windows_kernel_exploit.md
+++ b/doc/3.1.11_windows_kernel_exploit.md
@@ -1,4 +1,4 @@
-# 3.3.11 Windows 内核漏洞利用
+# 3.1.11 Windows 内核漏洞利用
 
 - [参考资料](#参考资料)
 
diff --git a/doc/3.1.12_race_condition.md b/doc/3.1.12_race_condition.md
new file mode 100644
index 0000000..73febf4
--- /dev/null
+++ b/doc/3.1.12_race_condition.md
@@ -0,0 +1 @@
+# 3.1.12 竞争条件
diff --git a/doc/3.3.1_format_string.md b/doc/3.1.1_format_string.md
similarity index 99%
rename from doc/3.3.1_format_string.md
rename to doc/3.1.1_format_string.md
index 30ef617..1e711da 100644
--- a/doc/3.3.1_format_string.md
+++ b/doc/3.1.1_format_string.md
@@ -1,4 +1,4 @@
-# 3.3.1 格式化字符串漏洞
+# 3.1.1 格式化字符串漏洞
 
 - [格式化输出函数和格式字符串](#格式化输出函数和格式字符串)
 - [格式化字符串漏洞基本原理](#格式化字符串漏洞基本原理)
@@ -292,7 +292,7 @@ printf("%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s")
 
 使程序崩溃只是验证漏洞的第一步，攻击者还可以利用格式化输出函数来获得内存的内容，为下一步漏洞利用做准备。我们已经知道了，格式化字符串函数会根据格式字符串从栈上取值。由于在 x86 上栈由高地址向低地址增长，而 `printf()` 函数的参数是以逆序被压入栈的，所以参数在内存中出现的顺序与在 `printf()` 调用时出现的顺序是一致的。
 
-下面的演示我们都使用下面的[源码](../src/Others/3.3.1_format_string/fmt_2.c)：
+下面的演示我们都使用下面的[源码](../src/others/3.1.1_format_string/fmt_2.c)：
 ```c
 #include<stdio.h>
 void main() {
@@ -1234,7 +1234,7 @@ pwnlib.fmtstr.fmtstr_payload(offset, writes, numbwritten=0, write_size='byte')
 - numbwritten (int)：已经由 printf 函数写入的字节数
 - write_size (str)：必须是 byte，short 或 int。告诉你是要逐 byte 写，逐 short 写还是逐 int 写（hhn，hn或n）
 
-我们通过一个例子来熟悉下该模块的使用（任意地址内存读写）：[fmt.c](../src/Others/3.3.1_format_string/fmt.c) [fmt](../src/Other/3.3.1_format_string/fmt)
+我们通过一个例子来熟悉下该模块的使用（任意地址内存读写）：[fmt.c](../src/others/3.1.1_format_string/fmt.c) [fmt](../src/others/3.1.1_format_string/fmt)
 ```c
 #include<stdio.h>
 void main() {
diff --git a/doc/3.3.2_integer_overflow.md b/doc/3.1.2_integer_overflow.md
similarity index 98%
rename from doc/3.3.2_integer_overflow.md
rename to doc/3.1.2_integer_overflow.md
index ed3fffc..1281da2 100644
--- a/doc/3.3.2_integer_overflow.md
+++ b/doc/3.1.2_integer_overflow.md
@@ -1,4 +1,4 @@
-# 3.3.2 整数溢出
+# 3.1.2 整数溢出
 
 - [什么是整数溢出](#什么是整数溢出)
 - [整数溢出](#整数溢出)
@@ -77,7 +77,7 @@ printf("ui = %u\n", ui);  // 在 x86-32 上，ui = 4 294 967 295
 #### 整型提升和宽度溢出
 整型提升是指当计算表达式中包含了不同宽度的操作数时，较小宽度的操作数会被提升到和较大操作数一样的宽度，然后再进行计算。
 
-示例：[源码](../src/Other/3.3.2_integer_overflow/width_overflow.c)
+示例：[源码](../src/others/3.1.2_integer_overflow/width_overflow.c)
 ```c
 #include<stdio.h>
 void main() {
@@ -254,7 +254,7 @@ void main(int argc, char *argv[]) {
 这个例子接受两个字符串类型的参数并计算它们的总长度，程序分配足够的内存来存储拼接后的字符串。首先将第一个字符串参数复制到缓冲区中，然后将第二个参数连接到尾部。如果攻击者提供的两个字符串总长度无法用 `total` 表示，则会发生截断，从而导致后面的缓冲区溢出。
 
 #### 实战
-看了上面的示例，我们来真正利用一个整数溢出漏洞。[源码](../src/Other/3.3.2_integer_overflow/integer.c)
+看了上面的示例，我们来真正利用一个整数溢出漏洞。[源码](../src/others/3.1.2_integer_overflow/integer.c)
 ```c
 #include<stdio.h>
 #include<string.h>
diff --git a/doc/3.1.3_stack_overflow.md b/doc/3.1.3_stack_overflow.md
new file mode 100644
index 0000000..adb18f2
--- /dev/null
+++ b/doc/3.1.3_stack_overflow.md
@@ -0,0 +1 @@
+# 3.1.3 栈溢出
diff --git a/doc/3.3.4_rop_x86.md b/doc/3.1.4_rop_x86.md
similarity index 99%
rename from doc/3.3.4_rop_x86.md
rename to doc/3.1.4_rop_x86.md
index d19e0f9..186b137 100644
--- a/doc/3.3.4_rop_x86.md
+++ b/doc/3.1.4_rop_x86.md
@@ -1,4 +1,4 @@
-# 3.3.4 返回导向编程（ROP）
+# 3.1.4 返回导向编程（ROP）
 
 - [ROP 简介](#rop-简介)
   - [寻找 gadgets](#寻找-gadgets)
@@ -60,10 +60,10 @@
 
 这些挑战都包含一个 `flag.txt` 的文件，我们的目标就是通过控制程序执行，来打印出文件中的内容。当然你也可以尝试获得 shell。
 
-[下载文件](../src/Others/3.3.4_rop/rop_emporium.bin)
+[下载文件](../src/others/3.1.4_rop/rop_emporium.bin)
 
 #### ret2win32
-通常情况下，对于一个有缓冲区溢出的程序，我们通常先输入一定数量的字符填满缓冲区，然后是精心构造的 ROP 链，通过覆盖堆栈上保存的返回地址来实现函数跳转（关于缓冲区溢出请查看上一章 3.3.3栈溢出）。
+通常情况下，对于一个有缓冲区溢出的程序，我们通常先输入一定数量的字符填满缓冲区，然后是精心构造的 ROP 链，通过覆盖堆栈上保存的返回地址来实现函数跳转（关于缓冲区溢出请查看上一章 3.1.3栈溢出）。
 
 第一个挑战我会尽量详细一点，因为所有挑战程序都有相似的结构，缓冲区大小都一样，我们看一下漏洞函数：
 ```
diff --git a/doc/3.1.5_rop_arm.md b/doc/3.1.5_rop_arm.md
new file mode 100644
index 0000000..9187c22
--- /dev/null
+++ b/doc/3.1.5_rop_arm.md
@@ -0,0 +1 @@
+# 3.1.5 返回导向编程（ROP）（ARM）
diff --git a/doc/3.3.6_heap_exploit_1.md b/doc/3.1.6_heap_exploit_1.md
similarity index 99%
rename from doc/3.3.6_heap_exploit_1.md
rename to doc/3.1.6_heap_exploit_1.md
index fcd1028..f5ec327 100644
--- a/doc/3.3.6_heap_exploit_1.md
+++ b/doc/3.1.6_heap_exploit_1.md
@@ -1,4 +1,4 @@
-# 3.3.6 Linux 堆利用（上）
+# 3.1.6 Linux 堆利用（上）
 
 - [Linux 堆简介](#linux-堆简介)
 - [how2heap](#how2heap)
@@ -31,7 +31,7 @@ $ cd how2heap
 $ make
 ```
 
-请注意，下文中贴出的代码是我简化过的，剔除和修改了一些不必要的注释和代码，以方便学习。另外，正如章节 4.3 中所讲的，添加编译参数 `CFLAGS += -fsanitize=address` 可以检测内存错误。[下载文件](../src/Others/3.3.6_heap_exploit)
+请注意，下文中贴出的代码是我简化过的，剔除和修改了一些不必要的注释和代码，以方便学习。另外，正如章节 4.3 中所讲的，添加编译参数 `CFLAGS += -fsanitize=address` 可以检测内存错误。[下载文件](../src/others/3.1.6_heap_exploit)
 
 #### first_fit
 ```c
diff --git a/doc/3.3.7_heap_exploit_2.md b/doc/3.1.7_heap_exploit_2.md
similarity index 99%
rename from doc/3.3.7_heap_exploit_2.md
rename to doc/3.1.7_heap_exploit_2.md
index d6dd6ff..5185a77 100644
--- a/doc/3.3.7_heap_exploit_2.md
+++ b/doc/3.1.7_heap_exploit_2.md
@@ -1,4 +1,4 @@
-# 3.3.7 Linux 堆利用（中）
+# 3.1.7 Linux 堆利用（中）
 
 - [how2heap](#how2heap)
   - [poison_null_byte](#poison_null_byte)
@@ -7,7 +7,7 @@
   - [overlapping_chunks_2](#overlapping_chunks_2)
 
 
-[下载文件](../src/Others/3.3.6_heap_exploit)
+[下载文件](../src/Others/3.1.6_heap_exploit)
 
 ## how2heap
 #### poison_null_byte
diff --git a/doc/3.3.8_heap_exploit_3.md b/doc/3.1.8_heap_exploit_3.md
similarity index 99%
rename from doc/3.3.8_heap_exploit_3.md
rename to doc/3.1.8_heap_exploit_3.md
index 633900f..32d3b0c 100644
--- a/doc/3.3.8_heap_exploit_3.md
+++ b/doc/3.1.8_heap_exploit_3.md
@@ -1,4 +1,4 @@
-# 3.3.8 Linux 堆利用（下）
+# 3.1.8 Linux 堆利用（下）
 
 - [how2heap](#how2heap)
   - [house_of_force](#house_of_force)
@@ -8,7 +8,7 @@
 - [参考资料](#参考资料)
 
 
-[下载文件](../src/Others/3.3.6_heap_exploit)
+[下载文件](../src/Others/3.1.6_heap_exploit)
 
 ## how2heap
 #### house_of_force
diff --git a/doc/3.3.9_kernel_rop.md b/doc/3.1.9_kernel_rop.md
similarity index 95%
rename from doc/3.3.9_kernel_rop.md
rename to doc/3.1.9_kernel_rop.md
index 10256c1..38f5de8 100644
--- a/doc/3.3.9_kernel_rop.md
+++ b/doc/3.1.9_kernel_rop.md
@@ -1,4 +1,4 @@
-# 3.3.9 内核 ROP
+# 3.1.9 内核 ROP
 
 - [参考资料](#参考资料)
 
diff --git a/doc/3.1_reverse.md b/doc/3.1_reverse.md
deleted file mode 100644
index 05b9c90..0000000
--- a/doc/3.1_reverse.md
+++ /dev/null
@@ -1,52 +0,0 @@
-# 3.1 Reverse
-
-- [怎样学习逆向工程](#怎样学习逆向工程)
-
-
-## 怎样学习逆向工程
-逆向工程一直被视为一种充满乐趣和带有神秘色彩的东西，逆向工程师看起来就像是在密密麻麻的指令中寻找宝藏的人，他们绕开层层的限制和保护，发现程序中的的错误、漏洞或者是被加密算法掩盖的数据结构。这里我会比较概括地介绍怎样去学习逆向工程。
-
-首先应该注意两个最关键的事情：
-- 逆向工程需要大量的练习。一个人不能只通过阅读教程来学习逆向工程，教程可能会教你一些技巧，工具的使用和一般的工作流程，但它们只应该作为补充，而不是学习过程的核心。
-- 逆向工程需要大量的时间。在逆向工程中，几个甚至几十个小时的工作是很正常的，请不要吝啬你的时间。
-
-对一个对象的逆向工程包含了三个意思：
-- 静态分析：分析二进制文件反编译后的结果。
-- 动态分析：对正在运行的进程使用调试器。
-- 行为分析：使用更高级的工具获得所选进程的行为。
-
-通常我建议在进行一系列逆向工程挑战（如 crackme 和 CTF）的时候混合使用上面的三种分析方法。
-
-我会在下面的部分分别详细介绍三种分析方法，并列出刚开始是需要熟悉的资料和工具。
-
-#### 静态分析
-
-#### 动态分析
-
-#### 行为分析
-行为分析与给定目标与环境交互的方式有关（主要是操作系统以及文件、套接字、管道、寄存器等各种资源）。
-
-我建议你从下面的工具开始：
-- [Process Monitor](https://docs.microsoft.com/en-us/sysinternals/downloads/procmon)是一个免费的 Windows 应用程序，可以让你监视系统范围内的访问，如文件、寄存器、网络以及进程相关的事件等。
-- [Process Hacker](http://processhacker.sourceforge.net/)和[Process Explorer](https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer)是可替代 Windows 任务管理器的工具，它们都提供了有关运行中程序的更多详细信息。
-- [Wireshark](https://www.wireshark.org/)是一个十分方便的跨平台的网络嗅探器。
-- [strace](https://linux.die.net/man/1/strace)是一个用于监视给定进程系统调用的 Linux 工具。
-- [ltrace](https://linux.die.net/man/1/ltrace)与 strace 类似，但它用于监视动态库调用。
-
-#### 其他有用的资源
-正如我一开始提到的，这里给出的只是学习之初的建议，它们在逆向工程领域中只是冰山一角。下面是一些学习资料。
-
-书籍：
-- Reverse Engineering for Beginners (2017) by Dennis Yurichev (CC BY-SA 4.0, so yes, it's free and open)
-- Practical Malware Analysis (2012) by Michael Sikorski and Andrew Honig
-- Practical Reverse Engineering (2014) by Bruce Dang, Alexandre Gazet, Elias Bachaalany, Sebastien Josse
-- Hacker Disassembling Uncovered (2003) by Kris Kaspersky
-- Reversing: Secrets of Reverse Engineering (2005) by Eldad Eilam
-
-其他资源：
-- [Tuts 4 You](https://tuts4you.com/)
-- [/r/ReverseEngineering](https://www.reddit.com/r/ReverseEngineering/)
-- [Reverse Engineering at StackExchange](https://reverseengineering.stackexchange.com/)
-- [PE Format](https://msdn.microsoft.com/en-us/library/windows/desktop/ms680547(v=vs.85).aspx)
-- [Executable and Linkable Format (ELF)](http://www.skyfree.org/linux/references/ELF_Format.pdf)
-- [Ange Albertini's executable format posters](https://github.com/corkami/pics/tree/master/binary)
diff --git a/doc/3.2.1_classic_crypto.md b/doc/3.2.1_classic_crypto.md
deleted file mode 100644
index da6983d..0000000
--- a/doc/3.2.1_classic_crypto.md
+++ /dev/null
@@ -1 +0,0 @@
-# 3.2.1 古典密码
diff --git a/doc/3.2_crypto.md b/doc/3.2_crypto.md
deleted file mode 100644
index eac3056..0000000
--- a/doc/3.2_crypto.md
+++ /dev/null
@@ -1,3 +0,0 @@
-# 3.2 Crypto
-
-- [3.2.1 古典密码](3.2.1_classic_crypto.md)
diff --git a/doc/3.3.12_race_condition.md b/doc/3.3.12_race_condition.md
deleted file mode 100644
index 7240a62..0000000
--- a/doc/3.3.12_race_condition.md
+++ /dev/null
@@ -1 +0,0 @@
-# 3.3.12 竞争条件
diff --git a/doc/3.3.1_sql_injection.md b/doc/3.3.1_sql_injection.md
new file mode 100644
index 0000000..fd700c1
--- /dev/null
+++ b/doc/3.3.1_sql_injection.md
@@ -0,0 +1 @@
+# 3.3.1 SQL 注入利用
diff --git a/doc/3.3.2_xss.md b/doc/3.3.2_xss.md
new file mode 100644
index 0000000..a1e3d12
--- /dev/null
+++ b/doc/3.3.2_xss.md
@@ -0,0 +1 @@
+# 3.3.1 XSS 漏洞利用
diff --git a/doc/3.3.3_stack_overflow.md b/doc/3.3.3_stack_overflow.md
deleted file mode 100644
index 04f32e8..0000000
--- a/doc/3.3.3_stack_overflow.md
+++ /dev/null
@@ -1 +0,0 @@
-# 3.3.3 栈溢出
diff --git a/doc/3.3.5_rop_arm.md b/doc/3.3.5_rop_arm.md
deleted file mode 100644
index 5661f89..0000000
--- a/doc/3.3.5_rop_arm.md
+++ /dev/null
@@ -1,7 +0,0 @@
-# 3.3.5 返回导向编程（ROP）（ARM）
-
-- [参考资料](#参考资料)
-
-
-## 参考资料
-- [Return Oriented Programming for the ARM Architecture](http://zma.es/Reversing-Exploiting/ROP/Return%20Oriented%20Programming%20for%20ARM.pdf)
diff --git a/doc/3.3_pwn.md b/doc/3.3_pwn.md
deleted file mode 100644
index 2eb93b2..0000000
--- a/doc/3.3_pwn.md
+++ /dev/null
@@ -1,14 +0,0 @@
-# 3.3 Pwn
-
-- [3.3.1 格式化字符串漏洞](3.3.1_format_string.md)
-- [3.3.2 整数溢出](3.3.2_integer_overflow.md)
-- [3.3.3 栈溢出](3.3.3_stack_overflow.md)
-- [3.3.4 返回导向编程（ROP）（x86）](3.3.4_rop_x86.md)
-- [3.3.5 返回导向编程（ROP）（ARM）](3.3.5_rop_arm.md)
-- [3.3.6 Linux 堆利用（上）](3.3.6_heap_exploit_1.md)
-- [3.3.7 Linux 堆利用（中）](3.3.7_heap_exploit_2.md)
-- [3.3.8 Linux 堆利用（下）](3.3.8_heap_exploit_3.md)
-- [3.3.9 内核 ROP](3.3.9_kernel_rop.md)
-- [3.3.10 Linux 内核漏洞利用](3.3.10_linux_kernel_exploit.md)
-- [3.3.11 Windows 内核漏洞利用](3.3.11_windows_kernel_exploit.md)
-- [3.3.12 竞争条件](3.3.12_race_condition.md)
diff --git a/doc/3.4.1_sql_injection.md b/doc/3.4.1_sql_injection.md
deleted file mode 100644
index bf4b8a4..0000000
--- a/doc/3.4.1_sql_injection.md
+++ /dev/null
@@ -1 +0,0 @@
-# 3.4.1 SQL 注入利用
\ No newline at end of file
diff --git a/doc/3.4.2_xss.md b/doc/3.4.2_xss.md
deleted file mode 100644
index bcf7ff1..0000000
--- a/doc/3.4.2_xss.md
+++ /dev/null
@@ -1 +0,0 @@
-# 3.4.1 XSS 漏洞利用
\ No newline at end of file
diff --git a/doc/3.4_web.md b/doc/3.4_web.md
deleted file mode 100644
index 222f548..0000000
--- a/doc/3.4_web.md
+++ /dev/null
@@ -1 +0,0 @@
-# 3.4 Web
diff --git a/doc/3.5_misc.md b/doc/3.5_misc.md
deleted file mode 100644
index 93f4bcb..0000000
--- a/doc/3.5_misc.md
+++ /dev/null
@@ -1,17 +0,0 @@
-# 3.5 Misc
-
-CTF中的Misc类题目，也称杂项题目，一般情况下包含取证分析、隐写术、编程等类型。
-
-## What should I learn？
-
-* 熟练掌握一门脚本语言(如Python)
-* 熟悉计算机组成原理、常见文件类型，熟悉各类网络协议
-
-
-
-## 3.5.1 Steg
-
-### 3.5.1.1 Tools
-
-* Stegsolve
-* binwalk
\ No newline at end of file
diff --git a/doc/3.6_mobile.md b/doc/3.6_mobile.md
deleted file mode 100644
index 9dae5d6..0000000
--- a/doc/3.6_mobile.md
+++ /dev/null
@@ -1 +0,0 @@
-# 3.6 Mobile
diff --git a/doc/3_topics.md b/doc/3_topics.md
index b4fcd00..2f0b831 100644
--- a/doc/3_topics.md
+++ b/doc/3_topics.md
@@ -1,23 +1,22 @@
 # 第三章 分类专题篇
 
-- [3.1 Reverse](3.1_reverse.md)
-- [3.2 Crypto](3.2_crypto.md)
-  - [3.2.1 古典密码](3.2.1_classic_crypto.md)
-- [3.3 Pwn](3.3_pwn.md)
-  - [3.3.1 格式化字符串漏洞](3.3.1_format_string.md)
-  - [3.3.2 整数溢出](3.3.2_integer_overflow.md)
-  - [3.3.3 栈溢出](3.3.3_stack_overflow.md)
-  - [3.3.4 返回导向编程（ROP）（x86）](3.3.4_rop_x86.md)
-  - [3.3.5 返回导向编程（ROP）（ARM）](3.3.5_rop_arm.md)
-  - [3.3.6 Linux 堆利用（上）](3.3.6_heap_exploit_1.md)
-  - [3.3.7 Linux 堆利用（中）](3.3.7_heap_exploit_2.md)
-  - [3.3.8 Linux 堆利用（下）](3.3.8_heap_exploit_3.md)
-  - [3.3.9 内核 ROP](3.3.9_kernel_rop.md)
-  - [3.3.10 Linux 内核漏洞利用](3.3.10_linux_kernel_exploit.md)
-  - [3.3.11 Windows 内核漏洞利用](3.3.11_windows_kernel_exploit.md)
-  - [3.3.12 竞争条件](3.3.12_race_condition.md)
-- [3.4 Web](3.4_web.md)
-  - [3.4.1 SQL 注入利用](3.4.1_sql_injection.md)
-  - [3.4.2 XSS 漏洞利用](3.4.2_xss.md)
-- [3.5 Misc](3.5_misc.md)
-- [3.6 Mobile](3.6_mobile.md)
+* Pwn
+  * [3.1.1 格式化字符串漏洞](3.1.1_format_string.md)
+  * [3.1.2 整数溢出](3.1.2_integer_overflow.md)
+  * [3.1.3 栈溢出](3.1.3_stack_overflow.md)
+  * [3.1.4 返回导向编程（ROP）（x86）](3.1.4_rop_x86.md)
+  * [3.1.5 返回导向编程（ROP）（ARM）](3.1.5_rop_arm.md)
+  * [3.1.6 Linux 堆利用（上）](3.1.6_heap_exploit_1.md)
+  * [3.1.7 Linux 堆利用（中）](3.1.7_heap_exploit_2.md)
+  * [3.1.8 Linux 堆利用（下）](3.1.8_heap_exploit_3.md)
+  * [3.1.9 内核 ROP](3.1.9_kernel_rop.md)
+  * [3.1.10 Linux 内核漏洞利用](3.1.10_linux_kernel_exploit.md)
+  * [3.1.11 Windows 内核漏洞利用](3.1.11_windows_kernel_exploit.md)
+  * [3.1.12 竞争条件](3.1.12_race_condition.md)
+* Reverse
+* Web
+  * [3.3.1 SQL 注入利用](3.3.1_sql_injection.md)
+  * [3.3.2 XSS 漏洞利用](3.3.2_xss.md)
+* Crypto
+* Misc
+* Mobile
diff --git a/doc/4.14_glibc_tcache.md b/doc/4.14_glibc_tcache.md
index dae8dcc..3d5ae9d 100644
--- a/doc/4.14_glibc_tcache.md
+++ b/doc/4.14_glibc_tcache.md
@@ -665,7 +665,7 @@ gdb-peda$ x/12gx 0x0000555555756000+0x10
 ```
 看来这个机制仍然存在很多的问题啊。
 
-这一节的代码可以在[这里](../src/Others/4.14_glibc_tcache)找到。其他的一些情况可以参考章节 3.3.6。
+这一节的代码可以在[这里](../src/others/4.14_glibc_tcache)找到。其他的一些情况可以参考章节 3.3.6。
 
 
 ## CTF 实例
diff --git a/doc/4.1_linux_kernel_debug.md b/doc/4.1_linux_kernel_debug.md
index 4542bb7..dc2c4f5 100644
--- a/doc/4.1_linux_kernel_debug.md
+++ b/doc/4.1_linux_kernel_debug.md
@@ -242,7 +242,7 @@ console=ttyS0
 
 现在我们已经可以对内核代码进行单步调试了。对于内核模块，我们同样可以进行调试，但模块是动态加载的，gdb 不会知道这些模块被加载到哪里，所以需要使用 `add-symbol-file` 命令来告诉它。
 
-来看一个 helloworld 的例子：
+来看一个 helloworld 的例子，[源码](../src/others/4.1_linux_kernel_debug)：
 ```c
 #include <linux/init.h>
 #include <linux/module.h>
diff --git a/doc/4_tips.md b/doc/4_tips.md
index 2c19278..f3a1378 100644
--- a/doc/4_tips.md
+++ b/doc/4_tips.md
@@ -1,17 +1,17 @@
 # 第四章 技巧篇
 
-- [4.1 Linux 内核调试](4.1_linux_kernel_debug.md)
-- [4.2 Linux 命令行技巧](4.2_Linux_terminal_tips.md)
-- [4.3 GCC 编译参数解析](4.3_gcc_arg.md)
-- [4.4 GCC 堆栈保护技术](4.4_gcc_sec.md)
-- [4.5 ROP 防御技术](4.5_defense_rop.md)
-- [4.6 one-gadget RCE](4.6_one-gadget_rce.md)
-- [4.7 通用 gadget](4.7_common_gadget.md)
-- [4.8 使用 DynELF 泄露函数地址](4.8_dynelf.md)
-- [4.9 patch 二进制文件](4.9_patch_binary.md)
-- [4.10 反调试技术](4.10_antidbg.md)
-- [4.11 指令混淆](4.11_instruction_confusion.md)
-- [4.12 利用 __stack_chk_fail](4.12_stack_chk_fail.md)
-- [4.13 利用 _IO_FILE 结构](4.13_io_file.md)
-- [4.14 glibc tcache 机制](4.14_glibc_tcache.md)
-- [4.15 利用 vsyscall 和 vDSO](4.15_vsyscall_vdso.md)
+* [4.1 Linux 内核调试](4.1_linux_kernel_debug.md)
+* [4.2 Linux 命令行技巧](4.2_Linux_terminal_tips.md)
+* [4.3 GCC 编译参数解析](4.3_gcc_arg.md)
+* [4.4 GCC 堆栈保护技术](4.4_gcc_sec.md)
+* [4.5 ROP 防御技术](4.5_defense_rop.md)
+* [4.6 one-gadget RCE](4.6_one-gadget_rce.md)
+* [4.7 通用 gadget](4.7_common_gadget.md)
+* [4.8 使用 DynELF 泄露函数地址](4.8_dynelf.md)
+* [4.9 patch 二进制文件](4.9_patch_binary.md)
+* [4.10 反调试技术](4.10_antidbg.md)
+* [4.11 指令混淆](4.11_instruction_confusion.md)
+* [4.12 利用 __stack_chk_fail](4.12_stack_chk_fail.md)
+* [4.13 利用 _IO_FILE 结构](4.13_io_file.md)
+* [4.14 glibc tcache 机制](4.14_glibc_tcache.md)
+* [4.15 利用 vsyscall 和 vDSO](4.15_vsyscall_vdso.md)
diff --git a/doc/5.2.1_pin.md b/doc/5.2.1_pin.md
index c3648cc..2aa98ea 100644
--- a/doc/5.2.1_pin.md
+++ b/doc/5.2.1_pin.md
@@ -269,6 +269,17 @@ Linux manjaro 4.11.5-1-ARCH #1 SMP PREEMPT Wed Jun 14 16:19:27 CEST 2017 x86_64
 Count 528090
 ```
 
+其它一些自带插件及功能如下：
+
+| 插件名 | 功能 |
+| -- | --- |
+| inscount | 统计执行的指令数量，输出到 inscount.out 文件 |
+| itrace | 记录执行指令的 eip |
+| malloctrace | 记录 malloc 和 free 的调用情况 |
+| pinatrace | 记录读写内存的位置和值 |
+| proccount | 统计 Procedure 的信息，包括名称、镜像、地址、指令数 |
+| w_malloctrace | 记录 RtlAllocateHeap 的调用情况 |
+
 
 ## Pintool 编写
 #### main 函数的编写
@@ -286,25 +297,23 @@ Pintool 的入口为 `main` 函数，通常需要完成下面的功能：
   ```
 - 注册不同粒度的回调函数：
   - TRACE（轨迹）粒度
-    - TRACE 表示一个单入口、多出口的指令序列的数据结构。Pin 将 TRACE 分为若干基本块 BBL（Basic Block），一个 BLL 是一个单入口、单出口的指令序列。注册 TRACE 粒度插桩函数原型为：
-    ：
+    - TRACE 表示一个单入口、多出口的指令序列的数据结构。Pin 将 TRACE 分为若干基本块 BBL（Basic Block），一个 BLL 是一个单入口、单出口的指令序列。TRACE 在指令发生跳转时进行插入，进一步进行基本块分析，常用于记录程序执行序列。注册 TRACE 粒度插桩函数原型为：
     ```
     TRACE_AddInstrumentFunction(TRACE_INSTRUMENT_CALLBACK fun, VOID *val)
     ```
   - IMG（镜像）粒度
     - IMG 表示整个被加载进内存的二进制可执行模块（如可执行文件、动态链接库等）类型的数据结构。每次被插桩进程在执行过程中加载了镜像类型文件时，就会被当做 IMG 类型处理。注册插桩 IMG 粒度加载和卸载的函数原型：
-    ：
     ```
     IMG_AddInstrumentFunction(IMAGECALLBACK fun, VOID *v)
     IMG_AddUnloadFunction(IMAGECALLBACK fun, VOID *v)
     ```
   - RTN（例程）粒度
-    - RTN 代表了由面向过程程序语言编译器产生的函数／例成／过程。Pin 使用符号表来查找例程。必须使用 `PIN_InitSymbols` 使得符号表信息可用。插桩 RTN 粒度函数原型：
+    - RTN 代表了由面向过程程序语言编译器产生的函数／例成／过程。Pin 使用符号表来查找例程，即需要插入的位置，需要调用内置的初始化表函数 `PIN_InitSymbols()`。必须使用 `PIN_InitSymbols` 使得符号表信息可用。插桩 RTN 粒度函数原型：
     ```
     RTN_AddInstrumentFunction(RTN_INSTRUMENT_CALLBACK fun, VOID *val)
     ```
   - INS（指令）粒度
-    - INS 代表一条指令对应的数据结构。INS 是最小的粒度，插桩 INS 粒度函数原型：
+    - INS 代表一条指令对应的数据结构，INS 是最小的粒度。INS 的代码插桩是在指令执行前、后插入附加代码，会导致程序执行缓慢。插桩 INS 粒度函数原型：
     ```
     INS_AddInstrumentFunction(INS_INSTRUMENT_CALLBACK fun, VOID *val)
     ```
@@ -335,7 +344,7 @@ Pintool 的入口为 `main` 函数，通常需要完成下面的功能：
 ## Pin 在 CTF 中的应用
 由于程序具有循环、分支等结构，每次运行时执行的指令数量不一定相同，于是我们可是使用 Pin 来统计执行指令的数量，从而对程序进行分析。特别是对一些使用特殊指令集和虚拟机，或者运用了反调试等技术的程序来说，相对于静态分析去死磕，动态插桩技术是一个比较好的选择。
 
-我们先举一个例子，[源码](../src/Others/5.2_pin/passwd.c)如下：
+我们先举一个例子，[源码](../src/others/5.2_pin/passwd.c)如下：
 ```c
 #include<stdio.h>
 #include<string.h>
diff --git a/doc/5.3.1_angr.md b/doc/5.3.1_angr.md
index 7f42134..a4ae15b 100644
--- a/doc/5.3.1_angr.md
+++ b/doc/5.3.1_angr.md
@@ -390,7 +390,7 @@ for i in range(12):
 print ''.join(passwd)
 ```
 
-逆向算法似乎也很简单，但如果连算法都不用逆的话，下面就是见证 angr 魔力的时刻，我们只需要指定让程序运行到 `0x400844`，即验证通过时的位置，而不用管验证的逻辑是怎么样的。完整的 exp 如下，其他文件在 [github](../src/Others/5.3.1_angr) 相应文件夹中。
+逆向算法似乎也很简单，但如果连算法都不用逆的话，下面就是见证 angr 魔力的时刻，我们只需要指定让程序运行到 `0x400844`，即验证通过时的位置，而不用管验证的逻辑是怎么样的。完整的 exp 如下，其他文件在 [github](../src/others/5.3.1_angr) 相应文件夹中。
 ```python
 import angr
 
diff --git a/doc/5.3_symbolic_execution.md b/doc/5.3_symbolic_execution.md
index 85eaacf..cbdba35 100644
--- a/doc/5.3_symbolic_execution.md
+++ b/doc/5.3_symbolic_execution.md
@@ -70,6 +70,12 @@ if (i > 0) {
 首先，将表示程序输入的变量 i 用符号 x 表示其取值，通过分别对 if 条件语句的两条分支进行分析，可以发现在赋值语句 a[i] = 1 处，当 x 的取值大于 0、小于 10 时，变量 i 的取值为 x，当 x 的取值大于 10 时，变量 i 的取值为 x % 10。通过分析约束 `(x>10∨x<10)∧(0<x∧x<10)` 和约束 `(x%10>10∨x%10<10)∧x>10` 的可满足性，可以发现漏洞的约束是不可满足的，于是认为漏洞不存在。
 
 #### 构造测试用例
+在符号执行的分析过程中，可以不断地获得程序可能执行路径上对程序输入的约束，在分析停止时，利用获得的对程序输入的一系列限制条件，构造满足限制条件的程序输入作为测试用例。
+
+在模拟程序执行并收集路径条件的过程中，如果同时收集可引起程序异常的符号取值的限制条件，并将异常条件和路径条件一起考虑，精心构造满足条件的测试用例作为程序的输入，那么在使用这样的输入的情况下，程序很可能在运行时出现异常。
+
+
+## 方法实现
 
 
 ## 参考资料
diff --git a/doc/5.7_cap-keystone.md b/doc/5.7_cap-keystone.md
deleted file mode 100644
index d7ca7ee..0000000
--- a/doc/5.7_cap-keystone.md
+++ /dev/null
@@ -1 +0,0 @@
-# Capstone/Keystone
diff --git a/doc/5.7_slicing.md b/doc/5.7_slicing.md
new file mode 100644
index 0000000..410819f
--- /dev/null
+++ b/doc/5.7_slicing.md
@@ -0,0 +1 @@
+# 5.7 程序切片
diff --git a/doc/5.8.1_z3.md b/doc/5.8.1_z3.md
index c539cd6..14f8dd3 100644
--- a/doc/5.8.1_z3.md
+++ b/doc/5.8.1_z3.md
@@ -314,7 +314,7 @@ solver.add(serial[11] / serial[3]  == 0)
 ```
 因为被除数不能为 0，所以 `serial[3]` 不能为 0。另外，每个序列号数字都是大于等于 0，小于 9 的。最后求解得到结果。
 
-完整的 exp 如下，其他文件在 [github](../src/Others/5.8.1_z3) 相应文件夹中。
+完整的 exp 如下，其他文件在 [github](../src/others/5.8.1_z3) 相应文件夹中。
 ```python
 from z3 import *
 
diff --git a/doc/5_advanced.md b/doc/5_advanced.md
index a345e51..4c03756 100644
--- a/doc/5_advanced.md
+++ b/doc/5_advanced.md
@@ -1,29 +1,28 @@
 # 第五章 高级篇
 
-- [5.0 软件漏洞分析](5.0_vulnerability.md)
-- [5.1 模糊测试](5.1_fuzzing.md)
-  - [5.1.1 AFL fuzzer](5.1.1_afl_fuzzer.md)
-  - [5.1.2 libFuzzer](5.1.2_libfuzzer.md)
-- [5.2 动态二进制插桩](5.2_dyn_binary_instrumentation.md)
-  - [5.2.1 Pin](5.2.1_pin.md)
-  - [5.2.2 DynamoRio](5.2.2_dynamorio.md)
-  - [5.2.3 Valgrind](5.2.3_valgrind.md)
-- [5.3 符号执行](5.3_symbolic_execution.md)
-  - [5.3.1 angr](5.3.1_angr.md)
-  - [5.3.2 Triton](5.3.2_triton.md)
-  - [5.3.3 KLEE](5.3.3_klee.md)
-  - [5.3.4 S²E](5.3.4_s2e.md)
-- [5.4 数据流分析](5.4_dataflow_analysis.md)
-  - [5.4.1 Soot](5.4.1_soot.md)
-- [5.5 污点分析](5.5_taint_analysis.md)
-  - [5.5.1 动态污点分析](doc/5.5.1_dyn_taint_analysis.md)
-- [5.6 LLVM](5.6_llvm.md)
- - [5.6.1 Clang](doc/5.6.1_clang.md)
-- [5.7 Capstone/Keystone](5.7_cap-keystone.md)
-- [5.8 SAT/SMT](5.8_sat-smt.md)
-  - [5.8.1 Z3](5.8.1_z3.md)
-- [5.9 基于模式的漏洞分析](5.9_pattern_based_detection.md)
-- [5.10 基于二进制比对的漏洞分析](5.10_diff_based_detection.md)
-- [5.11 反编译技术](5.11_decompiling.md)
-  - [5.11.1 RetDec](5.11.1_retdec.md)
-- [5.12 Unicorn 模拟器](5.12_unicorn.md)
+* [5.0 软件漏洞分析](5.0_vulnerability.md)
+* [5.1 模糊测试](5.1_fuzzing.md)
+  * [5.1.1 AFL fuzzer](5.1.1_afl_fuzzer.md)
+  * [5.1.2 libFuzzer](5.1.2_libfuzzer.md)
+* [5.2 动态二进制插桩](5.2_dyn_binary_instrumentation.md)
+  * [5.2.1 Pin](5.2.1_pin.md)
+  * [5.2.2 DynamoRio](5.2.2_dynamorio.md)
+  * [5.2.3 Valgrind](5.2.3_valgrind.md)
+* [5.3 符号执行](5.3_symbolic_execution.md)
+  * [5.3.1 angr](5.3.1_angr.md)
+  * [5.3.2 Triton](5.3.2_triton.md)
+  * [5.3.3 KLEE](5.3.3_klee.md)
+  * [5.3.4 S²E](5.3.4_s2e.md)
+* [5.4 数据流分析](5.4_dataflow_analysis.md)
+  * [5.4.1 Soot](5.4.1_soot.md)
+* [5.5 污点分析](5.5_taint_analysis.md)
+  * [5.5.1 动态污点分析](5.5.1_dyn_taint_analysis.md)
+* [5.6 LLVM](5.6_llvm.md)
+  * [5.6.1 Clang](5.6.1_clang.md)
+* [5.7 程序切片](5.7_slicing.md)
+* [5.8 SAT/SMT](5.8_sat-smt.md)
+  * [5.8.1 Z3](5.8.1_z3.md)
+* [5.9 基于模式的漏洞分析](5.9_pattern_based_detection.md)
+* [5.10 基于二进制比对的漏洞分析](5.10_diff_based_detection.md)
+* [5.11 反编译技术](5.11_decompiling.md)
+  * [5.11.1 RetDec](5.11.1_retdec.md)
diff --git a/doc/6_writeup.md b/doc/6_writeup.md
index edfe56d..f6b7539 100644
--- a/doc/6_writeup.md
+++ b/doc/6_writeup.md
@@ -1,32 +1,35 @@
 # 第六章 题解篇
 
-- pwn
-  - [6.1.1 pwn HCTF2016 brop](6.1.1_pwn_hctf2016_brop.md)
-  - [6.1.2 pwn NJCTF2017 pingme](6.1.2_pwn_njctf2017_pingme.md)
-  - [6.1.3 pwn XDCTF2015 pwn200](6.1.3_pwn_xdctf2015_pwn200.md)
-  - [6.1.4 pwn BackdoorCTF2017 Fun-Signals](6.1.4_pwn_backdoorctf2017_fun_signals.md)
-  - [6.1.5 pwn GreHackCTF2017 beerfighter](6.1.5_pwn_grehackctf2017_beerfighter.md)
-  - [6.1.6 pwn DefconCTF2015 fuckup](6.1.6_pwn_defconctf2015_fuckup.md)
-  - [6.1.7 pwn 0CTF2015 freenote](6.1.7_pwn_0ctf2015_freenote.md)
-  - [6.1.8 pwn DCTF2017 Flex](6.1.8_pwn_dctf2017_flex.md)
-  - [6.1.9 pwn RHme3 Exploitation](6.1.9_pwn_rhme3_exploitation.md)
-  - [6.1.10 pwn 0CTF2017 BabyHeap2017](6.1.10_pwn_0ctf2017_babyheap2017.md)
-  - [6.1.11 pwn 9447CTF2015 Search-Engine](6.1.11_pwn_9447ctf2015_search_engine.md)
-  - [6.1.12 pwn N1CTF2018 vote](6.1.12_pwn_n1ctf2018_vote.md)
-  - [6.1.13 pwn 34C3CTF2017 readme_revenge](6.1.13_pwn_34c3ctf2017_readme_revenge.md)
-  - [6.1.14 pwn 32C3CTF2015 readme](6.1.14_pwn_32c3ctf2015_readme.md)
-  - [6.1.15 pwn 34C3CTF2017 SimpleGC](6.1.15_pwn_34c3ctf2017_simplegc.md)
-  - [6.1.16 pwn HITBCTF2017 1000levels](6.1.16_pwn_hitbctf2017_1000levels.md)
-  - [6.1.17 pwn SECCONCTF2016 jmper](6.1.17_pwn_secconctf2016_jmper.md)
-  - [6.1.18 pwn HITBCTF2017 Sentosa](6.1.18_pwn_hitbctf2017_sentosa.md)
-  - [6.1.19 pwn HITBCTF2018 gundam](6.1.19_pwn_hitbctf2018_gundam.md)
-  - [6.1.20 pwn 33C3CTF2016 babyfengshui](6.1.20_pwn_33c3ctf2016_babyfengshui.md)
-- re
-  - [6.2.1 re XHPCTF2017 dont_panic](6.2.1_re_xhpctf2017_dont_panic.md)
-  - [6.2.2 re ECTF2016 tayy](6.2.2_re_ectf2016_tayy.md)
-  - [6.2.3 re Codegate2017 angrybird](6.2.3_re_codegate2017_angrybird.md)
-  - [6.2.4 re CSAWCTF2015 wyvern](6.2.4_re_csawctf2015_wyvern.md)
-  - [6.2.5 re PicoCTF2014 Baleful](6.2.5_re_picoctf2014_baleful.md)
-  - [6.2.6 re SECCON2017 printf_machine](6.2.6_re_seccon2017_printf_machine.md)
-- web
-  - [6.3.1 web HCTF2017 babycrack](6.3.1_web_hctf2017_babycrack.md)
+* Pwn
+  * [6.1.1 pwn HCTF2016 brop](6.1.1_pwn_hctf2016_brop.md)
+  * [6.1.2 pwn NJCTF2017 pingme](6.1.2_pwn_njctf2017_pingme.md)
+  * [6.1.3 pwn XDCTF2015 pwn200](6.1.3_pwn_xdctf2015_pwn200.md)
+  * [6.1.4 pwn BackdoorCTF2017 Fun-Signals](6.1.4_pwn_backdoorctf2017_fun_signals.md)
+  * [6.1.5 pwn GreHackCTF2017 beerfighter](6.1.5_pwn_grehackctf2017_beerfighter.md)
+  * [6.1.6 pwn DefconCTF2015 fuckup](6.1.6_pwn_defconctf2015_fuckup.md)
+  * [6.1.7 pwn 0CTF2015 freenote](6.1.7_pwn_0ctf2015_freenote.md)
+  * [6.1.8 pwn DCTF2017 Flex](6.1.8_pwn_dctf2017_flex.md)
+  * [6.1.9 pwn RHme3 Exploitation](6.1.9_pwn_rhme3_exploitation.md)
+  * [6.1.10 pwn 0CTF2017 BabyHeap2017](6.1.10_pwn_0ctf2017_babyheap2017.md)
+  * [6.1.11 pwn 9447CTF2015 Search-Engine](6.1.11_pwn_9447ctf2015_search_engine.md)
+  * [6.1.12 pwn N1CTF2018 vote](6.1.12_pwn_n1ctf2018_vote.md)
+  * [6.1.13 pwn 34C3CTF2017 readme_revenge](6.1.13_pwn_34c3ctf2017_readme_revenge.md)
+  * [6.1.14 pwn 32C3CTF2015 readme](6.1.14_pwn_32c3ctf2015_readme.md)
+  * [6.1.15 pwn 34C3CTF2017 SimpleGC](6.1.15_pwn_34c3ctf2017_simplegc.md)
+  * [6.1.16 pwn HITBCTF2017 1000levels](6.1.16_pwn_hitbctf2017_1000levels.md)
+  * [6.1.17 pwn SECCONCTF2016 jmper](6.1.17_pwn_secconctf2016_jmper.md)
+  * [6.1.18 pwn HITBCTF2017 Sentosa](6.1.18_pwn_hitbctf2017_sentosa.md)
+  * [6.1.19 pwn HITBCTF2018 gundam](6.1.19_pwn_hitbctf2018_gundam.md)
+  * [6.1.20 pwn 33C3CTF2016 babyfengshui](6.1.20_pwn_33c3ctf2016_babyfengshui.md)
+* Reverse
+  * [6.2.1 re XHPCTF2017 dont_panic](6.2.1_re_xhpctf2017_dont_panic.md)
+  * [6.2.2 re ECTF2016 tayy](6.2.2_re_ectf2016_tayy.md)
+  * [6.2.3 re Codegate2017 angrybird](6.2.3_re_codegate2017_angrybird.md)
+  * [6.2.4 re CSAWCTF2015 wyvern](6.2.4_re_csawctf2015_wyvern.md)
+  * [6.2.5 re PicoCTF2014 Baleful](6.2.5_re_picoctf2014_baleful.md)
+  * [6.2.6 re SECCON2017 printf_machine](6.2.6_re_seccon2017_printf_machine.md)
+* Web
+  * [6.3.1 web HCTF2017 babycrack](6.3.1_web_hctf2017_babycrack.md)
+* Crypto
+* Misc
+* Mobile
diff --git a/doc/7_exploit.md b/doc/7_exploit.md
index 664780c..4f8706a 100644
--- a/doc/7_exploit.md
+++ b/doc/7_exploit.md
@@ -1,12 +1,11 @@
 # 第七篇 实战篇
 
-- CVE
-  - [7.1.1 [CVE-2017-11543] tcpdump 4.9.0 Buffer Overflow](7.1.1_tcpdump_2017-11543.md)
-  - [7.1.2 [CVE-2015-0235] glibc 2.17 Buffer Overflow](7.1.2_glibc_2015-0235.md)
-  - [7.1.3 [CVE-2016-4971] wget 1.17.1 Arbitrary File Upload](7.1.3_wget_2016-4971.md)
-  - [7.1.4 [CVE-2017-13089] wget 1.19.1 Buffer Overflow](7.1.4_wget_2017-13089.md)
-  - [7.1.5 [CVE–2018-1000001] glibc Buffer Underflow](7.1.5_glibc_2018-1000001.md)
-  - [7.1.6 [CVE-2017-9430] DNSTracer 1.9 Buffer Overflow](7.1.6_dnstracer_2017-9430.md)
-  - [7.1.7 [CVE-2018-6323] GNU binutils 2.26.1 Integer Overflow](7.1.7_binutils_2018-6323.md)
-- Malware
-  - 7.2.x
+* CVE
+  * [7.1.1 [CVE-2017-11543] tcpdump 4.9.0 Buffer Overflow](7.1.1_tcpdump_2017-11543.md)
+  * [7.1.2 [CVE-2015-0235] glibc 2.17 Buffer Overflow](7.1.2_glibc_2015-0235.md)
+  * [7.1.3 [CVE-2016-4971] wget 1.17.1 Arbitrary File Upload](7.1.3_wget_2016-4971.md)
+  * [7.1.4 [CVE-2017-13089] wget 1.19.1 Buffer Overflow](7.1.4_wget_2017-13089.md)
+  * [7.1.5 [CVE–2018-1000001] glibc Buffer Underflow](7.1.5_glibc_2018-1000001.md)
+  * [7.1.6 [CVE-2017-9430] DNSTracer 1.9 Buffer Overflow](7.1.6_dnstracer_2017-9430.md)
+  * [7.1.7 [CVE-2018-6323] GNU binutils 2.26.1 Integer Overflow](7.1.7_binutils_2018-6323.md)
+* Malware
diff --git a/doc/8_academic.md b/doc/8_academic.md
index 20822e6..b10df89 100644
--- a/doc/8_academic.md
+++ b/doc/8_academic.md
@@ -3,27 +3,27 @@
 论文下载：
 链接：https://pan.baidu.com/s/1G-WFCzAU2VdrrsHqJzjGpw 密码：vhfw
 
-- [8.1 The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86)](8.1_ret2libc_without_func_calls.md)
-- [8.2 Return-Oriented Programming without Returns](8.2_rop_without_returns.md)
-- [8.3 Return-Oriented Rootkits: Bypassing Kernel Code Integrity Protection Mechanisms](8.3_rop_rootkits.md)
-- [8.4 ROPdefender: A Detection Tool to Defend Against Return-Oriented Programming Attacks](8.4_ropdefender.md)
-- [8.5 Data-Oriented Programming: On the Expressiveness of Non-Control Data Attacks](8.5_dop.md)
-- [8.6 Hacking Blind](8.6_brop.md)
-- [8.7 What Cannot Be Read, Cannot Be Leveraged? Revisiting Assumptions of JIT-ROP Defenses](8.7_jit-rop_defenses.md)
-- [8.8 All You Ever Wanted to Know About Dynamic Taint Analysis and Forward Symbolic Execution (but might have been afraid to ask)](8.8_dynamic_taint_analysis.md)
-- [8.9 Symbolic Execution for Software Testing: Three Decades Later](8.9_symbolic_execution.md)
-- [8.10 AEG: Automatic Exploit Generation](8.10_aeg.md)
-- [8.11 Address Space Layout Permutation (ASLP): Towards Fine-Grained Randomization of Commodity Software](8.11_aslp.md)
-- [8.12 ASLR on the Line: Practical Cache Attacks on the MMU](8.12_aslr_on_the_line.md)
-- [8.13 New Frontiers of Reverse Engineering](8.13_reverse_engineering.md)
-- [8.14 Who Allocated My Memory? Detecting Custom Memory Allocators in C Binaries](8.14_detecting_memory_allocators.md)
-- [8.15 EMULATOR vs REAL PHONE: Android Malware Detection Using Machine Learning](8.15_emulator_vs_real_phone.md)
-- [8.16 DynaLog: An automated dynamic analysis framework for characterizing Android applications](8.16_dynalog.md)
-- [8.17 A Static Android Malware Detection Based on Actual Used Permissions Combination and API Calls](8.17_actual_used_permissions.md)
-- [8.18 MaMaDroid: Detecting Android malware by building Markov chains of behavioral models](8.18_malware_markov_chains.md)
-- [8.19 DroidNative: Semantic-Based Detection of Android Native Code Malware](8.19_droidnative.md)
-- [8.20 DroidAnalytics: A Signature Based Analytic System to Collect, Extract, Analyze and Associate Android Malware](8.20_droidanalytics.md)
-- [8.21 Micro-Virtualization Memory Tracing to Detect and Prevent Spraying Attacks](8.21_tracing_to_detect_spraying.md)
-- [8.22 Practical Memory Checking With Dr. Memory](8.22_memory_checking.md)
-- [8.23 Evaluating the Effectiveness of Current Anti-ROP Defenses](8.23_current_anti-rop.md)
-- [8.24 How to Make ASLR Win the Clone Wars: Runtime Re-Randomization](8.24_runtime_re-randomization.md)
+* [8.1 The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86)](8.1_ret2libc_without_func_calls.md)
+* [8.2 Return-Oriented Programming without Returns](8.2_rop_without_returns.md)
+* [8.3 Return-Oriented Rootkits: Bypassing Kernel Code Integrity Protection Mechanisms](8.3_rop_rootkits.md)
+* [8.4 ROPdefender: A Detection Tool to Defend Against Return-Oriented Programming Attacks](8.4_ropdefender.md)
+* [8.5 Data-Oriented Programming: On the Expressiveness of Non-Control Data Attacks](8.5_dop.md)
+* [8.6 Hacking Blind](8.6_brop.md)
+* [8.7 What Cannot Be Read, Cannot Be Leveraged? Revisiting Assumptions of JIT-ROP Defenses](8.7_jit-rop_defenses.md)
+* [8.8 All You Ever Wanted to Know About Dynamic Taint Analysis and Forward Symbolic Execution (but might have been afraid to ask)](8.8_dynamic_taint_analysis.md)
+* [8.9 Symbolic Execution for Software Testing: Three Decades Later](8.9_symbolic_execution.md)
+* [8.10 AEG: Automatic Exploit Generation](8.10_aeg.md)
+* [8.11 Address Space Layout Permutation (ASLP): Towards Fine-Grained Randomization of Commodity Software](8.11_aslp.md)
+* [8.12 ASLR on the Line: Practical Cache Attacks on the MMU](8.12_aslr_on_the_line.md)
+* [8.13 New Frontiers of Reverse Engineering](8.13_reverse_engineering.md)
+* [8.14 Who Allocated My Memory? Detecting Custom Memory Allocators in C Binaries](8.14_detecting_memory_allocators.md)
+* [8.15 EMULATOR vs REAL PHONE: Android Malware Detection Using Machine Learning](8.15_emulator_vs_real_phone.md)
+* [8.16 DynaLog: An automated dynamic analysis framework for characterizing Android applications](8.16_dynalog.md)
+* [8.17 A Static Android Malware Detection Based on Actual Used Permissions Combination and API Calls](8.17_actual_used_permissions.md)
+* [8.18 MaMaDroid: Detecting Android malware by building Markov chains of behavioral models](8.18_malware_markov_chains.md)
+* [8.19 DroidNative: Semantic-Based Detection of Android Native Code Malware](8.19_droidnative.md)
+* [8.20 DroidAnalytics: A Signature Based Analytic System to Collect, Extract, Analyze and Associate Android Malware](8.20_droidanalytics.md)
+* [8.21 Micro-Virtualization Memory Tracing to Detect and Prevent Spraying Attacks](8.21_tracing_to_detect_spraying.md)
+* [8.22 Practical Memory Checking With Dr. Memory](8.22_memory_checking.md)
+* [8.23 Evaluating the Effectiveness of Current Anti-ROP Defenses](8.23_current_anti-rop.md)
+* [8.24 How to Make ASLR Win the Clone Wars: Runtime Re-Randomization](8.24_runtime_re-randomization.md)
diff --git a/doc/9.2_wintools.md b/doc/9.2_wintools.md
index 8e087a6..fee2b9d 100644
--- a/doc/9.2_wintools.md
+++ b/doc/9.2_wintools.md
@@ -8,7 +8,6 @@
 - [PortEx Analyzer](#portex-analyzer)
 - [Resource Hacker](#resource-hacker)
 - [wxHexEditor](#wxhexeditor)
-- [x64Dbg](#x64dbg)
 
 
 ## 010 Editor
@@ -36,6 +35,3 @@ http://www.angusj.com/resourcehacker/
 
 ## wxHexEditor
 http://www.wxhexeditor.org/
-
-## x64Dbg
-http://x64dbg.com/
diff --git a/doc/9_appendix.md b/doc/9_appendix.md
index 86c181f..6358aa7 100644
--- a/doc/9_appendix.md
+++ b/doc/9_appendix.md
@@ -3,5 +3,5 @@
 * [9.1 更多 Linux 工具](9.1_Linuxtools.md)
 * [9.2 更多 Windows 工具](9.2_wintools.md)
 * [9.3 更多资源](9.3_books_blogs.md)
-* [9.4 Linux x86-64 系统调用表](9.4_linux_syscall.md)
+* [9.4 Linux 系统调用表](9.4_linux_syscall.md)
 * [9.5 幻灯片](9.5_slides.md)
diff --git a/pic/2.2_gdb.png b/pic/2.3.1_gdb.png
similarity index 100%
rename from pic/2.2_gdb.png
rename to pic/2.3.1_gdb.png
diff --git a/pic/2.12_burp_intruder1.png b/pic/2.4.5_intruder1.png
similarity index 100%
rename from pic/2.12_burp_intruder1.png
rename to pic/2.4.5_intruder1.png
diff --git a/pic/2.12_burp_intruder2.png b/pic/2.4.5_intruder2.png
similarity index 100%
rename from pic/2.12_burp_intruder2.png
rename to pic/2.4.5_intruder2.png
diff --git a/pic/2.12_burp_intruder3.png b/pic/2.4.5_intruder3.png
similarity index 100%
rename from pic/2.12_burp_intruder3.png
rename to pic/2.4.5_intruder3.png
diff --git a/pic/2.12_burp_proxy1.png b/pic/2.4.5_proxy1.png
similarity index 100%
rename from pic/2.12_burp_proxy1.png
rename to pic/2.4.5_proxy1.png
diff --git a/pic/2.12_burp_proxy2.png b/pic/2.4.5_proxy2.png
similarity index 100%
rename from pic/2.12_burp_proxy2.png
rename to pic/2.4.5_proxy2.png
diff --git a/src/Others/2.2_gdb/serial_number_300 b/src/Others/2.2_gdb/serial_number_300
deleted file mode 100755
index 101f014..0000000
Binary files a/src/Others/2.2_gdb/serial_number_300 and /dev/null differ
diff --git a/src/Others/1.5.7_memory/brk.c b/src/others/1.5.7_memory/brk.c
similarity index 100%
rename from src/Others/1.5.7_memory/brk.c
rename to src/others/1.5.7_memory/brk.c
diff --git a/src/Others/1.5.7_memory/mmap.c b/src/others/1.5.7_memory/mmap.c
similarity index 100%
rename from src/Others/1.5.7_memory/mmap.c
rename to src/others/1.5.7_memory/mmap.c
diff --git a/src/Others/1.5.7_memory/stack.c b/src/others/1.5.7_memory/stack.c
similarity index 100%
rename from src/Others/1.5.7_memory/stack.c
rename to src/others/1.5.7_memory/stack.c
diff --git a/src/Others/1.5.8_glibc_malloc/malloc-2.23.c b/src/others/1.5.8_glibc_malloc/malloc-2.23.c
similarity index 100%
rename from src/Others/1.5.8_glibc_malloc/malloc-2.23.c
rename to src/others/1.5.8_glibc_malloc/malloc-2.23.c
diff --git a/src/Others/1.5.9_linux_kernel/config-fragment b/src/others/1.5.9_linux_kernel/config-fragment
similarity index 100%
rename from src/Others/1.5.9_linux_kernel/config-fragment
rename to src/others/1.5.9_linux_kernel/config-fragment
diff --git a/src/Others/1.5.9_linux_kernel/hello32.S b/src/others/1.5.9_linux_kernel/hello32.S
similarity index 100%
rename from src/Others/1.5.9_linux_kernel/hello32.S
rename to src/others/1.5.9_linux_kernel/hello32.S
diff --git a/src/Others/1.5.9_linux_kernel/hello64.S b/src/others/1.5.9_linux_kernel/hello64.S
similarity index 100%
rename from src/Others/1.5.9_linux_kernel/hello64.S
rename to src/others/1.5.9_linux_kernel/hello64.S
diff --git a/src/Others/2.1_vm/pwn_env.sh b/src/others/2.1.1_vm/pwn_env.sh
similarity index 100%
rename from src/Others/2.1_vm/pwn_env.sh
rename to src/others/2.1.1_vm/pwn_env.sh
diff --git a/src/Others/2.7_pwntools/binutils.sh b/src/others/2.4.1_pwntools/binutils.sh
similarity index 100%
rename from src/Others/2.7_pwntools/binutils.sh
rename to src/others/2.4.1_pwntools/binutils.sh
diff --git a/src/Others/3.3.1_format_string/fmt b/src/others/3.1.1_format_string/fmt
similarity index 100%
rename from src/Others/3.3.1_format_string/fmt
rename to src/others/3.1.1_format_string/fmt
diff --git a/src/Others/3.3.1_format_string/fmt.c b/src/others/3.1.1_format_string/fmt.c
similarity index 100%
rename from src/Others/3.3.1_format_string/fmt.c
rename to src/others/3.1.1_format_string/fmt.c
diff --git a/src/Others/3.3.1_format_string/fmt_2.c b/src/others/3.1.1_format_string/fmt_2.c
similarity index 100%
rename from src/Others/3.3.1_format_string/fmt_2.c
rename to src/others/3.1.1_format_string/fmt_2.c
diff --git a/src/Others/3.3.2_integer_overflow/integer.c b/src/others/3.1.2_integer_overflow/integer.c
similarity index 100%
rename from src/Others/3.3.2_integer_overflow/integer.c
rename to src/others/3.1.2_integer_overflow/integer.c
diff --git a/src/Others/3.3.2_integer_overflow/width_overflow.c b/src/others/3.1.2_integer_overflow/width_overflow.c
similarity index 100%
rename from src/Others/3.3.2_integer_overflow/width_overflow.c
rename to src/others/3.1.2_integer_overflow/width_overflow.c
diff --git a/src/Others/3.3.4_rop/rop_emporium.bin b/src/others/3.1.4_rop/rop_emporium.bin
similarity index 100%
rename from src/Others/3.3.4_rop/rop_emporium.bin
rename to src/others/3.1.4_rop/rop_emporium.bin
diff --git a/src/Others/3.3.6_heap_exploit/Makefile b/src/others/3.1.6_heap_exploit/Makefile
similarity index 100%
rename from src/Others/3.3.6_heap_exploit/Makefile
rename to src/others/3.1.6_heap_exploit/Makefile
diff --git a/src/Others/3.3.6_heap_exploit/fastbin_dup.c b/src/others/3.1.6_heap_exploit/fastbin_dup.c
similarity index 100%
rename from src/Others/3.3.6_heap_exploit/fastbin_dup.c
rename to src/others/3.1.6_heap_exploit/fastbin_dup.c
diff --git a/src/Others/3.3.6_heap_exploit/fastbin_dup_consolidate.c b/src/others/3.1.6_heap_exploit/fastbin_dup_consolidate.c
similarity index 100%
rename from src/Others/3.3.6_heap_exploit/fastbin_dup_consolidate.c
rename to src/others/3.1.6_heap_exploit/fastbin_dup_consolidate.c
diff --git a/src/Others/3.3.6_heap_exploit/fastbin_dup_into_stack.c b/src/others/3.1.6_heap_exploit/fastbin_dup_into_stack.c
similarity index 100%
rename from src/Others/3.3.6_heap_exploit/fastbin_dup_into_stack.c
rename to src/others/3.1.6_heap_exploit/fastbin_dup_into_stack.c
diff --git a/src/Others/3.3.6_heap_exploit/first_fit.c b/src/others/3.1.6_heap_exploit/first_fit.c
similarity index 100%
rename from src/Others/3.3.6_heap_exploit/first_fit.c
rename to src/others/3.1.6_heap_exploit/first_fit.c
diff --git a/src/Others/3.3.6_heap_exploit/house_of_einherjar.c b/src/others/3.1.6_heap_exploit/house_of_einherjar.c
similarity index 100%
rename from src/Others/3.3.6_heap_exploit/house_of_einherjar.c
rename to src/others/3.1.6_heap_exploit/house_of_einherjar.c
diff --git a/src/Others/3.3.6_heap_exploit/house_of_force.c b/src/others/3.1.6_heap_exploit/house_of_force.c
similarity index 100%
rename from src/Others/3.3.6_heap_exploit/house_of_force.c
rename to src/others/3.1.6_heap_exploit/house_of_force.c
diff --git a/src/Others/3.3.6_heap_exploit/house_of_lore.c b/src/others/3.1.6_heap_exploit/house_of_lore.c
similarity index 100%
rename from src/Others/3.3.6_heap_exploit/house_of_lore.c
rename to src/others/3.1.6_heap_exploit/house_of_lore.c
diff --git a/src/Others/3.3.6_heap_exploit/house_of_orange.c b/src/others/3.1.6_heap_exploit/house_of_orange.c
similarity index 100%
rename from src/Others/3.3.6_heap_exploit/house_of_orange.c
rename to src/others/3.1.6_heap_exploit/house_of_orange.c
diff --git a/src/Others/3.3.6_heap_exploit/house_of_spirit.c b/src/others/3.1.6_heap_exploit/house_of_spirit.c
similarity index 100%
rename from src/Others/3.3.6_heap_exploit/house_of_spirit.c
rename to src/others/3.1.6_heap_exploit/house_of_spirit.c
diff --git a/src/Others/3.3.6_heap_exploit/overlapping_chunks.c b/src/others/3.1.6_heap_exploit/overlapping_chunks.c
similarity index 100%
rename from src/Others/3.3.6_heap_exploit/overlapping_chunks.c
rename to src/others/3.1.6_heap_exploit/overlapping_chunks.c
diff --git a/src/Others/3.3.6_heap_exploit/overlapping_chunks_2.c b/src/others/3.1.6_heap_exploit/overlapping_chunks_2.c
similarity index 100%
rename from src/Others/3.3.6_heap_exploit/overlapping_chunks_2.c
rename to src/others/3.1.6_heap_exploit/overlapping_chunks_2.c
diff --git a/src/Others/3.3.6_heap_exploit/poison_null_byte.c b/src/others/3.1.6_heap_exploit/poison_null_byte.c
similarity index 100%
rename from src/Others/3.3.6_heap_exploit/poison_null_byte.c
rename to src/others/3.1.6_heap_exploit/poison_null_byte.c
diff --git a/src/Others/3.3.6_heap_exploit/tcache_double-free.c b/src/others/3.1.6_heap_exploit/tcache_double-free.c
similarity index 100%
rename from src/Others/3.3.6_heap_exploit/tcache_double-free.c
rename to src/others/3.1.6_heap_exploit/tcache_double-free.c
diff --git a/src/Others/3.3.6_heap_exploit/unsafe_unlink.c b/src/others/3.1.6_heap_exploit/unsafe_unlink.c
similarity index 100%
rename from src/Others/3.3.6_heap_exploit/unsafe_unlink.c
rename to src/others/3.1.6_heap_exploit/unsafe_unlink.c
diff --git a/src/Others/3.3.6_heap_exploit/unsorted_bin_attack.c b/src/others/3.1.6_heap_exploit/unsorted_bin_attack.c
similarity index 100%
rename from src/Others/3.3.6_heap_exploit/unsorted_bin_attack.c
rename to src/others/3.1.6_heap_exploit/unsorted_bin_attack.c
diff --git a/src/Others/4.14_glibc_tcache/Makefile b/src/others/4.14_glibc_tcache/Makefile
similarity index 100%
rename from src/Others/4.14_glibc_tcache/Makefile
rename to src/others/4.14_glibc_tcache/Makefile
diff --git a/src/Others/4.14_glibc_tcache/tcache_dup.c b/src/others/4.14_glibc_tcache/tcache_dup.c
similarity index 100%
rename from src/Others/4.14_glibc_tcache/tcache_dup.c
rename to src/others/4.14_glibc_tcache/tcache_dup.c
diff --git a/src/Others/4.14_glibc_tcache/tcache_house_of_spirit.c b/src/others/4.14_glibc_tcache/tcache_house_of_spirit.c
similarity index 100%
rename from src/Others/4.14_glibc_tcache/tcache_house_of_spirit.c
rename to src/others/4.14_glibc_tcache/tcache_house_of_spirit.c
diff --git a/src/Others/4.14_glibc_tcache/tcache_overlapping_chunks.c b/src/others/4.14_glibc_tcache/tcache_overlapping_chunks.c
similarity index 100%
rename from src/Others/4.14_glibc_tcache/tcache_overlapping_chunks.c
rename to src/others/4.14_glibc_tcache/tcache_overlapping_chunks.c
diff --git a/src/Others/4.14_glibc_tcache/tcache_poisoning.c b/src/others/4.14_glibc_tcache/tcache_poisoning.c
similarity index 100%
rename from src/Others/4.14_glibc_tcache/tcache_poisoning.c
rename to src/others/4.14_glibc_tcache/tcache_poisoning.c
diff --git a/src/Others/4.1_linux_kernel_debug/Makefile b/src/others/4.1_linux_kernel_debug/Makefile
similarity index 100%
rename from src/Others/4.1_linux_kernel_debug/Makefile
rename to src/others/4.1_linux_kernel_debug/Makefile
diff --git a/src/Others/4.1_linux_kernel_debug/create_initramfs.sh b/src/others/4.1_linux_kernel_debug/create_initramfs.sh
similarity index 100%
rename from src/Others/4.1_linux_kernel_debug/create_initramfs.sh
rename to src/others/4.1_linux_kernel_debug/create_initramfs.sh
diff --git a/src/Others/4.1_linux_kernel_debug/hello.c b/src/others/4.1_linux_kernel_debug/hello.c
similarity index 100%
rename from src/Others/4.1_linux_kernel_debug/hello.c
rename to src/others/4.1_linux_kernel_debug/hello.c
diff --git a/src/Others/5.2.1_pin/passwd.c b/src/others/5.2.1_pin/passwd.c
similarity index 100%
rename from src/Others/5.2.1_pin/passwd.c
rename to src/others/5.2.1_pin/passwd.c
diff --git a/src/Others/5.3.1_angr/entry_language b/src/others/5.3.1_angr/entry_language
similarity index 100%
rename from src/Others/5.3.1_angr/entry_language
rename to src/others/5.3.1_angr/entry_language
diff --git a/src/Others/5.3.1_angr/exp_angr.py b/src/others/5.3.1_angr/exp_angr.py
similarity index 100%
rename from src/Others/5.3.1_angr/exp_angr.py
rename to src/others/5.3.1_angr/exp_angr.py
diff --git a/src/Others/5.3.1_angr/exp_re.py b/src/others/5.3.1_angr/exp_re.py
similarity index 100%
rename from src/Others/5.3.1_angr/exp_re.py
rename to src/others/5.3.1_angr/exp_re.py
diff --git a/src/Others/5.3_symbolic_execution/tree.gv b/src/others/5.3_symbolic_execution/tree.gv
similarity index 100%
rename from src/Others/5.3_symbolic_execution/tree.gv
rename to src/others/5.3_symbolic_execution/tree.gv
diff --git a/src/Others/5.4_dataflow_analysis/cfg1.gv b/src/others/5.4_dataflow_analysis/cfg1.gv
similarity index 100%
rename from src/Others/5.4_dataflow_analysis/cfg1.gv
rename to src/others/5.4_dataflow_analysis/cfg1.gv
diff --git a/src/Others/5.4_dataflow_analysis/cfg2.gv b/src/others/5.4_dataflow_analysis/cfg2.gv
similarity index 100%
rename from src/Others/5.4_dataflow_analysis/cfg2.gv
rename to src/others/5.4_dataflow_analysis/cfg2.gv
diff --git a/src/Others/5.4_dataflow_analysis/cg.gv b/src/others/5.4_dataflow_analysis/cg.gv
similarity index 100%
rename from src/Others/5.4_dataflow_analysis/cg.gv
rename to src/others/5.4_dataflow_analysis/cg.gv
diff --git a/src/Others/5.4_dataflow_analysis/sm.gv b/src/others/5.4_dataflow_analysis/sm.gv
similarity index 100%
rename from src/Others/5.4_dataflow_analysis/sm.gv
rename to src/others/5.4_dataflow_analysis/sm.gv
diff --git a/src/Others/5.6_llvm/hello.bc b/src/others/5.6_llvm/hello.bc
similarity index 100%
rename from src/Others/5.6_llvm/hello.bc
rename to src/others/5.6_llvm/hello.bc
diff --git a/src/Others/5.6_llvm/hello.c b/src/others/5.6_llvm/hello.c
similarity index 100%
rename from src/Others/5.6_llvm/hello.c
rename to src/others/5.6_llvm/hello.c
diff --git a/src/Others/5.6_llvm/hello.ll b/src/others/5.6_llvm/hello.ll
similarity index 100%
rename from src/Others/5.6_llvm/hello.ll
rename to src/others/5.6_llvm/hello.ll
diff --git a/src/Others/5.6_llvm/hello.s b/src/others/5.6_llvm/hello.s
similarity index 100%
rename from src/Others/5.6_llvm/hello.s
rename to src/others/5.6_llvm/hello.s
diff --git a/src/Others/5.8.1_z3/exp.py b/src/others/5.8.1_z3/exp.py
similarity index 100%
rename from src/Others/5.8.1_z3/exp.py
rename to src/others/5.8.1_z3/exp.py
diff --git a/src/Others/5.8.1_z3/harder_serial.py b/src/others/5.8.1_z3/harder_serial.py
similarity index 100%
rename from src/Others/5.8.1_z3/harder_serial.py
rename to src/others/5.8.1_z3/harder_serial.py