7 files changed, 97 insertions, 3 deletions
diff --git a/src/SUMMARY.md b/src/SUMMARY.md
index ac41b1a..5af20c9 100644
--- a/src/SUMMARY.md
+++ b/src/SUMMARY.md
@@ -20,6 +20,7 @@
     - [xargs](./cli/xargs.md)
     - [grep](./cli/grep.md)
     - [find](./cli/find.md)
+    - [dd](./cli/dd.md)
 
 - [Tools](./tools/README.md)
     - [tmux](./tools/tmux.md)
diff --git a/src/arch/x86_64.md b/src/arch/x86_64.md
index e6c26fe..888d302 100644
--- a/src/arch/x86_64.md
+++ b/src/arch/x86_64.md
@@ -498,6 +498,7 @@ itself.
 - [GNU Assembler Directives][gas_directives]
 - [GNU Assembler `x86_64` dependent features][gas_x86_64]
 - [`juicebox-asm` an `x86_64` jit assembler playground][juicebox]
+- [zig x86 bare metal examples][x86-zig-bm]
 
 
 [sysvabi]: https://gitlab.com/x86-psABIs/x86-64-ABI
@@ -519,3 +520,4 @@ itself.
 [linux-swapgs]: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/x86/entry/entry_64.S?h=v6.13#n87
 [x86-syscall]: https://www.felixcloutier.com/x86/syscall
 [x86-swapgs]: https://www.felixcloutier.com/x86/swapgs
+[x86-zig-bm]: https://git.memzero.de/testground/zig-playground/tree/x86-bare-metal
diff --git a/src/binary/xxd.md b/src/binary/xxd.md
index cd76f14..8ff7a37 100644
--- a/src/binary/xxd.md
+++ b/src/binary/xxd.md
@@ -34,3 +34,10 @@
     >> };
     >> unsigned int _proc_self_fd_11_len = 4;
 ```
+
+## Patching binary file by hand in hex mode
+```markdown
+  xxd /bin/ls > ls.hex
+  # edit binary file in hex format (ascii)
+  xxd -r ls.hex > ls
+```
diff --git a/src/cli/README.md b/src/cli/README.md
index ffde988..2a115e3 100644
--- a/src/cli/README.md
+++ b/src/cli/README.md
@@ -12,3 +12,4 @@
 - [xargs](./xargs.md)
 - [grep](./grep.md)
 - [find](./find.md)
+- [dd](./dd.md)
diff --git a/src/cli/dd.md b/src/cli/dd.md
new file mode 100644
index 0000000..709cfa0
--- /dev/null
+++ b/src/cli/dd.md
@@ -0,0 +1,46 @@
+# dd(1)
+
+Copy data `block-wise`.
+
+```
+dd [opts]
+    if=<path>         input file to read (stdin in case not specified)
+    of=<path>         oputput file to write
+    status=progress   show progress while copying
+    bs=<bytes>        block size
+    count=<n>         copy only <n> blocks
+    skip=<n>          skip <n> blocks in input (seek input)
+    seek=<n>          skip <n> blocks in oputput (seek output)
+    conv=<conv>
+         notrunc      dont truncate output file
+         excl         fail if output already exists
+         nocreat      fail if output does not exists
+```
+
+## Example: bootstick
+
+```bash
+dd bs=4M if=<iso> of=<blkdev> oflag=sync status=progress
+```
+
+## Example: patch file in place
+
+```bash
+# Create a 1024 bytes file filled with zeros.
+dd if=/dev/zero of=disk bs=512 count=2
+
+# Overwrite 4 bytes starting at byte 0.
+printf "aaaa" | dd of=disk bs=1 seek=0 conv=notrunc
+
+# Overwrite 4 bytes starting at byte 512.
+printf "bbbb" | dd of=disk bs=1 seek=512 conv=notrunc
+
+hexdump disk
+# 0000000 6161 6161 0000 0000 0000 0000 0000 0000
+# 0000010 0000 0000 0000 0000 0000 0000 0000 0000
+# *
+# 0000200 6262 6262 0000 0000 0000 0000 0000 0000
+# 0000210 0000 0000 0000 0000 0000 0000 0000 0000
+# *
+# 0000400
+```
diff --git a/src/development/gas.md b/src/development/gas.md
index a3da13f..126f84d 100644
--- a/src/development/gas.md
+++ b/src/development/gas.md
@@ -1,13 +1,24 @@
 # gas
 
 ## Frequently used directives
+- `.section` to define a section (elf files)
+  ```x86asm
+  .section .text.foo, "ax", @progbits
+  ; defines section named .text.foo with alloc+exec perms
+
+  .section .data.foo, "aw", @progbits
+  ; defines section named .data.foo with alloc+write perms
+
+  .section .rodata.foo, "a", @progbits
+  ; defines section named .rodata.foo with alloc perms
+  ```
 - `.byte`, `.2byte`, `.4byte`, `.8byte` to define a N byte value
   ```x86asm
   .byte 0xaa
-  .2byte 0xaabb
+  .2byte 0xaabb                 # .word
   .2byte 0xaa, 0xbb
-  .4byte 0xaabbccdd
-  .8byte 0xaabbccdd11223344
+  .4byte 0xaabbccdd             # .long
+  .8byte 0xaabbccdd11223344     # .quad
   ```
 - `.ascii` to define an ascii string
   ```x86asm
@@ -31,8 +42,30 @@
   defstr foo, "foobar"
   ```
   > Use `\()` to concatenate macro argument and literal.
+- `.rept` to repeat a sequence of lines between `.rept` and `.endr`.
+  ```x86asm
+  .rept 4
+  .4byte 123
+  .endr
+  ```
+- `.fill cnt, elem_size, val` write `cnt` times `val` with element size `elem_size`. For example one can use it to create a mbr boot record (magic number 0xaa55 at byte 511, 512).
+  ```x86asm
+  .section .boot, "ax", @progbits
+  ; some code ..
+  .4byte 0xff
 
+  .fill 510 - (. - .boot), 1, 0x00
+  .2byte 0xaa55
+
+  ; as foo.s && objdump -j .boot -s
+  ; Contents of section .boot:
+  ; 0000 ff000000 00000000 00000000 00000000
+  ; ..
+  ; 01f0 00000000 00000000 00000000 000055aa
+  ```
+  > Here `.` stands for the current location counter.
 
+## References
 - [GNU Assembler][gas_doc]
 - [GNU Assembler Directives][gas_directives]
 - [GNU Assembler `x86_64` dependent features][gas_x86_64]
diff --git a/src/tools/qemu.md b/src/tools/qemu.md
index 4351435..c887efb 100644
--- a/src/tools/qemu.md
+++ b/src/tools/qemu.md
@@ -63,6 +63,10 @@ qemu-system-x86_64                 \
 
 # Confifure virtio as 3D video graphic accelerator (requires virgl in guest).
 -vga virtio
+
+# Disable graphical output, and redirect serial console to qemu processes stdio
+# (-serial stdio).
+-nographic
 ```
 
 ### Boot Menu