diff --git a/.gitignore b/.gitignore
index 5b526f8..425d7b2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,3 +5,6 @@ result
 *.vcd
 *.npy
 *.npz
+*.hex
+*.bin
+*.elf
diff --git a/Makefile b/Makefile
index 38bd9de..d350d99 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,10 @@
 
+#
+# picorv32 / sbst config
+#
+
+SBST_SRCS := $(wildcard sbst_programs/*.c)
+
 #
 # jpeg_core config
 #
@@ -21,7 +27,7 @@ JPEG_CORE_TB     := jpeg_core_tb.v
 all: $(JPEG_CORE_VVP)
 
 clean:
-	rm -f $(JPEG_CORE_VVP) $(JPEG_CORE_OUTFILE) *.vcd
+	rm -f $(JPEG_CORE_VVP) $(JPEG_CORE_OUTFILE) *.vcd $(SBST_SRCS:.c=.bin) $(SBST_SRCS:.c=.hex)
 
 #
 # jpeg_core targets
@@ -45,4 +51,15 @@ test_ez_vcd:
 	make -C picorv32 test_ez_vcd
 
 testbench.npy:
-	./picorv32_vcd_import.py picorv32/testbench.vcd testbench.npy
\ No newline at end of file
+	./picorv32_vcd_import.py picorv32/testbench.vcd testbench.npy
+
+sbst_programs: $(SBST_SRCS:.c=.bin) $(SBST_SRCS:.c=.hex)
+
+sbst_programs/%.elf: sbst_programs/%.c sbst_programs/start.S
+	riscv64-unknown-elf-gcc -march=rv32ima_zicsr -mabi=ilp32 -ffreestanding -O0 -nostdlib -o $@ $^ -T picorv32/firmware/riscv.ld
+
+sbst_programs/%.bin: sbst_programs/%.elf
+	riscv64-unknown-elf-objcopy -O binary $^ $@
+
+sbst_programs/%.hex: sbst_programs/%.bin
+	python3 -c "import os; d=open('$^','rb').read(); [print('{:02x}{:02x}{:02x}{:02x}'.format(d[i+3],d[i+2],d[i+1],d[i])) for i in range(0,len(d),4)]" > $@
\ No newline at end of file
diff --git a/sbst_programs/alu.c b/sbst_programs/alu.c
new file mode 100644
index 0000000..9800eaa
--- /dev/null
+++ b/sbst_programs/alu.c
@@ -0,0 +1,80 @@
+#include <stdint.h>
+
+#define MISR_START() (*(volatile uint32_t *)0x40000000 = 1)
+#define MISR_STOP()  (*(volatile uint32_t *)0x40000000 = 0)
+#define SIM_FINISH() (*(volatile uint32_t *)0x20000000 = 1)
+volatile uint32_t sink;
+
+void trigger_untestable_counters() {
+    uint32_t cycle_low, cycle_high;
+
+    __asm__ volatile ("rdcycle %0" : "=r"(cycle_low));
+    __asm__ volatile ("rdcycleh %0" : "=r"(cycle_high));
+
+    sink = cycle_low ^ cycle_high;
+    sink = cycle_low + cycle_high;
+}
+
+void bomb_alu_full_coverage() {
+    volatile uint32_t p1 = 0xAAAAAAAA; // 10101010...
+    volatile uint32_t p2 = 0x55555555; // 01010101...
+    volatile uint32_t p3 = 0xFFFFFFFF; // 全 1
+    volatile uint32_t p4 = 0x80000000; // 仅最高位为 1 (符号位测试)
+    volatile uint32_t p5 = 0x00000001; // 仅最低位为 1
+
+    for (int i = 0; i < 12; i++) {
+        sink = p1 + p2;        // 加法
+        sink = p3 + p5;
+        sink = p3 + p4;
+        sink = p1 - p2;        // 减法
+        sink = p5 - p3;
+
+       volatile uint32_t sink1 = p3 - p5;
+        volatile uint32_t sink2;
+        for(int lop = 0; lop < 5 ; lop++){
+            sink2 = sink1 - p5;
+            sink1 = sink2 ^ 0xFFFFFFFF;
+        }
+        sink = sink1;
+
+        sink = p1 ^ p2;        // XOR
+        sink = p1 ^ p3;
+        sink = p2 ^ p3;
+        sink = p1 & p2;        // AND
+        sink = p3 & p2;
+        sink = p1 & p3;
+        sink = p1 | p2;        // OR
+        sink = p3 | p2;
+        sink = p1 | p3;
+
+        sink = p1 << i;                     // 逻辑左移 (SLL)
+        sink = p2 >> i;                     // 逻辑右移 (SRL)
+        sink = (int32_t)p4 >> i;            // 算术右移 (SRA)
+
+        sink = (int32_t)p1 < (int32_t)p2;   // 有符号比较 (Signed)
+        sink = p1 < p2;                     // 无符号比较 (Unsigned)
+
+        p1 = ~p1;
+        p2 = ~p2;
+        p4 = (p4 >> 1) | 0x80000000;
+        p5 = p5 << 1;
+    }
+}
+
+int main() {
+    sink = 0;
+
+    MISR_START();
+
+    for(int loop = 0; loop < 2; loop++) {
+        trigger_untestable_counters();
+        bomb_alu_full_coverage();
+    }
+
+    MISR_STOP();
+    SIM_FINISH();
+    while(1) {
+        __asm__ volatile ("nop");
+    }
+    return 0;
+}
diff --git a/sbst_programs/start.S b/sbst_programs/start.S
new file mode 100644
index 0000000..e6f7fe9
--- /dev/null
+++ b/sbst_programs/start.S
@@ -0,0 +1,14 @@
+/* start.S */
+.section .text
+.global _start
+
+_start:
+    /* 1. 初始化栈指针 (Stack Pointer) */
+    /* tb.v里内存大小是 4096 words (16KB) */
+    li sp, 0x4000 
+
+    call main
+
+    /* 3. 如果 main 返回了（理论上不该返回），死循环兜底 */
+loop:
+    j loop
diff --git a/sbst_programs/template.c b/sbst_programs/template.c
new file mode 100644
index 0000000..6bfa8ee
--- /dev/null
+++ b/sbst_programs/template.c
@@ -0,0 +1,22 @@
+#include <stdint.h>
+
+#define MISR_START() (*(volatile uint32_t *)0x40000000 = 1)
+#define MISR_STOP()  (*(volatile uint32_t *)0x40000000 = 0)
+#define SIM_FINISH() (*(volatile uint32_t *)0x20000000 = 1)
+volatile uint32_t sink;
+
+int main() {
+    sink = 0;
+
+    MISR_START();
+
+    // Your Code here.
+    sink = 1;
+
+    MISR_STOP();
+    SIM_FINISH();
+    while(1) {
+        __asm__ volatile ("nop");
+    }
+    return 0;
+}