diff --git a/.github/workflows/test-verifier.yml b/.github/workflows/test-verifier.yml
index 2011336b..6b6c26c6 100644
--- a/.github/workflows/test-verifier.yml
+++ b/.github/workflows/test-verifier.yml
@@ -19,8 +19,7 @@ jobs:
           sudo apt-get install binutils-dev libboost1.74-all-dev libelf-dev zlib1g-dev ninja-build libyaml-cpp-dev -y
       - name: Build test target
         run: |
-          cmake -DBPFTIME_ENABLE_UNIT_TESTING=YES -DBPFTIME_LLVM_JIT=NO -DENABLE_EBPF_VERIFIER=YES -DCMAKE_BUILD_TYPE:STRING=Release -S . -B build -G Ninja
-          cmake --build build --config Release --target bpftime_verifier_tests
+          make build-with-user-verifier
       - name: Run tests
         run: |
           ./build/bpftime-verifier/bpftime_verifier_tests
diff --git a/.gitmodules b/.gitmodules
index 8efb3c8b..50ee9135 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -7,3 +7,6 @@
 [submodule "verifier/ebpf-verifier"]
 	path = bpftime-verifier/ebpf-verifier
 	url = https://github.com/vbpf/ebpf-verifier
+[submodule "third_party/Catch2"]
+	path = third_party/Catch2
+	url = https://github.com/catchorg/Catch2.git
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 405e7183..e4ee4852 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -77,6 +77,8 @@ endif()
 
 # spdlog
 add_subdirectory(third_party/spdlog)
+# catch2
+add_subdirectory(third_party/Catch2)
 
 set(SPDLOG_INCLUDE ${CMAKE_CURRENT_SOURCE_DIR}/third_party/spdlog/include)
 
diff --git a/Makefile b/Makefile
index 3a8692af..f50a58cb 100644
--- a/Makefile
+++ b/Makefile
@@ -63,6 +63,10 @@ build-llvm: ## build with llvm as jit backend
 	cmake -Bbuild  -DBPFTIME_ENABLE_UNIT_TESTING=1 -DBPFTIME_LLVM_JIT=1
 	cmake --build build --config Debug
 
+build-with-user-verifier: ## build with userspace ebpf verifier
+	cmake -DBPFTIME_ENABLE_UNIT_TESTING=YES -DBPFTIME_LLVM_JIT=NO -DENABLE_EBPF_VERIFIER=YES -DCMAKE_BUILD_TYPE:STRING=Release -B build
+	cmake --build build --config Release --target bpftime_verifier_tests
+
 clean: ## clean the project
 	rm -rf build
 	make -C runtime clean
diff --git a/bpftime-verifier/CMakeLists.txt b/bpftime-verifier/CMakeLists.txt
index 6e5e0c7a..b2db86d6 100644
--- a/bpftime-verifier/CMakeLists.txt
+++ b/bpftime-verifier/CMakeLists.txt
@@ -21,16 +21,6 @@ set(TEST_SOURCES
     test/non_kernel_helper.cpp
 )
 
-Include(FetchContent)
-
-FetchContent_Declare(
-    Catch2
-    GIT_REPOSITORY https://github.com/catchorg/Catch2.git
-    GIT_TAG v3.0.1
-)
-
-FetchContent_MakeAvailable(Catch2)
-
 add_executable(bpftime_verifier_tests ${TEST_SOURCES})
 add_dependencies(bpftime_verifier_tests bpftime-verifier)
 target_link_libraries(bpftime_verifier_tests PRIVATE bpftime-verifier Catch2::Catch2WithMain)
diff --git a/daemon/kernel/bpf_tracer.bpf.c b/daemon/kernel/bpf_tracer.bpf.c
index 11dda8c3..8e2017c7 100644
--- a/daemon/kernel/bpf_tracer.bpf.c
+++ b/daemon/kernel/bpf_tracer.bpf.c
@@ -398,7 +398,7 @@ process_perf_event_open_enter(struct trace_event_raw_sys_enter *ctx)
 		return 0;
 	}
 	bpf_probe_read_user(&new_attr_buffer, sizeof(new_attr_buffer), attr);
-	struct perf_event_attr* new_attr_pointer = &new_attr_buffer;
+	struct perf_event_attr* new_attr_pointer = (struct perf_event_attr*)&new_attr_buffer;
 	if (new_attr_pointer->type == uprobe_perf_type) {
 		// found uprobe
 		if (enable_replace_uprobe) {
diff --git a/daemon/test/CMakeLists.txt b/daemon/test/CMakeLists.txt
index be5363d5..d2d37c22 100644
--- a/daemon/test/CMakeLists.txt
+++ b/daemon/test/CMakeLists.txt
@@ -1,12 +1,3 @@
-Include(FetchContent)
-FetchContent_Declare(
-    Catch2
-    GIT_REPOSITORY https://github.com/catchorg/Catch2.git
-    GIT_TAG v3.0.1
-)
-
-FetchContent_MakeAvailable(Catch2)
-
 find_package(Boost REQUIRED)
 
 set(TEST_SOURCES
diff --git a/example/hot_patch/redis/.gitignore b/example/patch/redis/.gitignore
similarity index 100%
rename from example/hot_patch/redis/.gitignore
rename to example/patch/redis/.gitignore
diff --git a/example/hot_patch/redis/Makefile b/example/patch/redis/Makefile
similarity index 100%
rename from example/hot_patch/redis/Makefile
rename to example/patch/redis/Makefile
diff --git a/example/hot_patch/redis/README.md b/example/patch/redis/README.md
similarity index 100%
rename from example/hot_patch/redis/README.md
rename to example/patch/redis/README.md
diff --git a/example/hot_patch/redis/ffi.bpf.h b/example/patch/redis/ffi.bpf.h
similarity index 100%
rename from example/hot_patch/redis/ffi.bpf.h
rename to example/patch/redis/ffi.bpf.h
diff --git a/example/hot_patch/redis/redis-patch.bpf.c b/example/patch/redis/redis-patch.bpf.c
similarity index 100%
rename from example/hot_patch/redis/redis-patch.bpf.c
rename to example/patch/redis/redis-patch.bpf.c
diff --git a/example/hot_patch/redis/redis-patch.c b/example/patch/redis/redis-patch.c
similarity index 100%
rename from example/hot_patch/redis/redis-patch.c
rename to example/patch/redis/redis-patch.c
diff --git a/example/hot_patch/redis/redis-server.h b/example/patch/redis/redis-server.h
similarity index 100%
rename from example/hot_patch/redis/redis-server.h
rename to example/patch/redis/redis-server.h
diff --git a/example/hot_patch/vim/README.md b/example/patch/vim/README.md
similarity index 100%
rename from example/hot_patch/vim/README.md
rename to example/patch/vim/README.md
diff --git a/example/hot_patch/vim/poc.bpf.c b/example/patch/vim/poc.bpf.c
similarity index 100%
rename from example/hot_patch/vim/poc.bpf.c
rename to example/patch/vim/poc.bpf.c
diff --git a/example/sslsniff/README.md b/example/sslsniff/README.md
index 609c46a1..1613548c 100644
--- a/example/sslsniff/README.md
+++ b/example/sslsniff/README.md
@@ -1,5 +1,2 @@
 # sslsniff
 
-Not working because we refactored the runtime.
-
-TODO: make the ring buffer work again.
diff --git a/runtime/test/bpf/global.bpf.c b/runtime/test/bpf/global.bpf.c
deleted file mode 100644
index ab486034..00000000
--- a/runtime/test/bpf/global.bpf.c
+++ /dev/null
@@ -1,24 +0,0 @@
-/* SPDX-License-Identifier: MIT
- *
- * Copyright (c) 2022, eunomia-bpf org
- * All rights reserved.
- */
-const int i = 0;
-static int j = 1;
-int k = 1;
-typedef unsigned long long uint64_t;
-struct data {
-	uint64_t context;
-};
-
-int add1(struct data *d, int sz) {
- 	return i + j;
-}
-
-int add2(struct data *d, int sz) {
- 	return i + k;
-}
-
-int add3(struct data *d, int sz) {
- 	return j + k;
-}
diff --git a/runtime/test/bpf/patch.bpf.c b/runtime/test/bpf/patch.bpf.c
deleted file mode 100644
index cce016ab..00000000
--- a/runtime/test/bpf/patch.bpf.c
+++ /dev/null
@@ -1,73 +0,0 @@
-/* SPDX-License-Identifier: MIT
- *
- * Copyright (c) 2022, eunomia-bpf org
- * All rights reserved.
- */
-typedef unsigned long long uint64_t;
-
-enum PatchOp {
-	OP_SKIP,
-	OP_RESUME,
-};
-
-struct patch_args {
-	void *ctx; // frida-context
-	uint64_t arg0;
-	uint64_t arg1;
-	uint64_t arg2;
-	uint64_t arg3;
-	uint64_t arg4;
-	uint64_t arg5;
-	// arg6-argN danymically get from stack
-	
-	uint64_t return_val;
-} __attribute__((packed));
-
-#define PATCH_HELPER_ID_DISPATCHER 2000
-
-static const uint64_t (*bpftime_bpf_get_args)(struct patch_args *args, int n) = (void *)PATCH_HELPER_ID_DISPATCHER;
-
-static inline int get_arg_n(struct patch_args *args, int n) {
-	switch (n) {
-	case 0:
-		return args->arg0;
-	case 1:
-		return args->arg1;
-	case 2:
-		return args->arg2;
-	case 3:
-		return args->arg3;
-	case 4:
-		return args->arg4;
-	case 5:
-		return args->arg5;
-	default:
-		return bpftime_bpf_get_args(args, n);
-		// return n + 1;
-	}
-	return 0;
-}
-
-typedef long long int64_t;
-
-// test replace
-int64_t my_add(struct patch_args *args) {
-	int64_t a1 = get_arg_n(args, 0);
-	int64_t a2 = get_arg_n(args, 1);
-	int64_t a3 = get_arg_n(args, 2);
-	int64_t a4 = get_arg_n(args, 3);
-	int64_t a5 = get_arg_n(args, 4);
-	int64_t a6 = get_arg_n(args, 5);
-	int64_t a7 = get_arg_n(args, 6);
-	int64_t a8 = get_arg_n(args, 7);
-
-	args->return_val = a1 + a2 + a3 + a4 + a5 + a6 + a7 + a8 + 1;
-
-	if (args->return_val < 40) {
-		return OP_SKIP;
-	} else if (args->return_val < 100) {
-		return OP_SKIP;
-	}
-
-	return OP_RESUME;
-}
\ No newline at end of file
diff --git a/runtime/unit-test/CMakeLists.txt b/runtime/unit-test/CMakeLists.txt
index f7640b8c..c3379037 100644
--- a/runtime/unit-test/CMakeLists.txt
+++ b/runtime/unit-test/CMakeLists.txt
@@ -1,11 +1,3 @@
-Include(FetchContent)
-FetchContent_Declare(
-    Catch2
-    GIT_REPOSITORY https://github.com/catchorg/Catch2.git
-    GIT_TAG v3.0.1
-)
-
-FetchContent_MakeAvailable(Catch2)
 
 find_package(Boost REQUIRED)
 
diff --git a/third_party/Catch2 b/third_party/Catch2
new file mode 160000
index 00000000..32d9ae24
--- /dev/null
+++ b/third_party/Catch2
@@ -0,0 +1 @@
+Subproject commit 32d9ae24bc4a0fed9a136a73e116b4ded0ac84b7
diff --git a/tools/cli-rs/src/main.rs b/tools/cli-rs/src/main.rs
index 3b6126b4..3beb5b13 100644
--- a/tools/cli-rs/src/main.rs
+++ b/tools/cli-rs/src/main.rs
@@ -153,6 +153,7 @@ fn run_command(
     }
     Ok(())
 }
+
 #[allow(unused)]
 fn my_execve(
     path: impl AsRef<str>,
diff --git a/vm/README.md b/vm/README.md
index f414c741..f37c7532 100644
--- a/vm/README.md
+++ b/vm/README.md
@@ -41,4 +41,5 @@ see [github.com/eunomia-bpf/bpf-benchmark](https://github.com/eunomia-bpf/bpf-be
 
 ## Roadmap
 
+- [ ] Replace simple JIT with ubpf
 - [ ] AOT support for LLVM JIT