diff --git a/Makefile b/Makefile
index 22eca8b..14739bd 100644
--- a/Makefile
+++ b/Makefile
@@ -42,7 +42,7 @@ CFLAGS  += --stack-auto --noinduction --use-non-free
 LDFLAGS  = -m$(ARCH) -l$(ARCH) --out-fmt-ihx
 
 OPTION_BOOT := 0x480D
-RAM_BOOT    := 0x023E
+RAM_BOOT    := 0x0232
 OPTFLAGS = -Wl-bOPTION=0x4800 -Wl-bOPTION_BOOT=$(OPTION_BOOT)
 B2FLAGS  = -Wl-bRAM_BOOT=$(RAM_BOOT)
 
@@ -130,8 +130,10 @@ boot2: $(SCRIPTS_DIR)/boot2.s | $(BUILD_DIR)
 	@B2SIZE=$$(wc -c < $(SCRIPTS_DIR)/boot2.bin); \
 	SIZE1K=$$(($$B2SIZE+$(RAM_BOOT)+(0x4840-$(OPTION_BOOT)-3))); \
 	if [ $$SIZE1K -ne 1024 ]; then \
-        echo ""; \
-        echo "!!! boot2 ram address error!!! $(RAM_BOOT)"; \
+		echo ""; \
+		echo "!!! boot2 ram address error!!!"; \
+		NEW_RAM_BOOT=$$((1024-$$SIZE1K+$(RAM_BOOT))); \
+		echo "    RAM_BOOT: $(RAM_BOOT) -> 0x$$(printf "%X" $$NEW_RAM_BOOT)"; \
 	fi
 
 # Show sizes of generated binaries
diff --git a/scripts/boot2.bin b/scripts/boot2.bin
index dd59d62..274ffba 100644
Binary files a/scripts/boot2.bin and b/scripts/boot2.bin differ
diff --git a/scripts/boot2.s b/scripts/boot2.s
index 6c1d647..c6523bb 100644
--- a/scripts/boot2.s
+++ b/scripts/boot2.s
@@ -30,6 +30,7 @@ WWDG_CR     = 0x50D1   ; WWDG control register
 CMD_READ    = 0xF1     ; 读内存命令
 CMD_WRITE   = 0xF2     ; 写内存命令
 CMD_GO      = 0xF3     ; 跳转执行命令
+CMD_EXEC    = 0xF4     ; 直接执行机器码命令
 
 CMD_HEADER   = 0x5A    ; 帧头
 ACK_HEADER   = 0xA5    ; 应答帧头
@@ -90,6 +91,9 @@ _main_loop:
     cp A, #CMD_GO
     jreq _cmd_go
 
+    cp A, #CMD_EXEC
+    jreq _cmd_exec
+
 _invalid_cmd_error:
     ; 未知命令，发送错误响应
     mov tx_state, #ERR_INVCMD
@@ -118,6 +122,13 @@ _cmd_go:
     jp (X)
     ; 注意: jump_to_address 不返回
 
+_cmd_exec:
+    ; 直接执行收到的机器码
+    ld A, #0x81     ; ret code
+    ld (X), A       ; X point to checksum already
+    call rx_buffer
+    jra _main_loop
+
 receive_frame:
     ; 初始化接收状态
     clr rx_state