From b2ae977cc0e2dc8cea642c0174d8d403821c42ec Mon Sep 17 00:00:00 2001
From: b1n <120295547+b1nhack@users.noreply.github.com>
Date: Sat, 22 Jun 2024 22:18:46 +0800
Subject: [PATCH] docs: add why section

---
 README.md | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/README.md b/README.md
index 7472a40..01b0108 100644
--- a/README.md
+++ b/README.md
@@ -6,14 +6,7 @@
 
 **PumpBin** is an Implant Generation Platform.
 
-Modern cybersecurity teams are divided into offensive personnel and cybersecurity researchers, with researchers responsible for producing digital weapons. The teams typically deploy post-exploitation tools like Cobalt Strike, BRC4, or similar.
-To evade security software, researchers usually write shellcode loaders, including evasion code to create the final implant. This process generally follows two methods.
-
-1. Offensive personnel provide the shellcode to researchers, who then directly produce the final implant. This method is highly inflexible as offensive personnel must contact researchers every time they need a final implant.
-
-2. Researchers create a binary implant template and provide a final implant generation program. Offensive personnel use this program to inject shellcode into the binary implant template, producing the final implant.
-
-The second method is the reason for the creation of PumpBin, a final implant generation program. Cybersecurity researchers only need to follow PumpBin's guidelines to write implant templates and distribute them along with PumpBin to offensive personnel. (There are very few guidelines as PumpBin is highly flexible.)
+To use PumpBin, you need to have a b1n file or create one. A b1n file contains one or more binary implant templates, along with some additional descriptive information. We refer to a b1n file as a Plugin.
 ![](https://github.com/pumpbin/pumpbin/assets/120295547/549bbfa8-d8a4-44c6-89e1-3f24ef7897d2)
 
 ## ✨ Features
@@ -28,3 +21,15 @@ The second method is the reason for the creation of PumpBin, a final implant gen
 * Support description, you can write down anything you want to remind users, which is important
 * No network connection, eliminating any security concerns
 * ... And I'm a pumpkin, I have magic🪄
+
+## ❔ Why
+
+
+Modern cybersecurity teams are divided into offensive personnel and cybersecurity researchers, with researchers responsible for producing digital weapons. The teams typically deploy post-exploitation tools like Cobalt Strike, BRC4, or similar.
+To evade security software, researchers usually write shellcode loaders, including evasion code to create the final implant. This process generally follows two methods.
+
+1. Offensive personnel provide the shellcode to researchers, who then directly produce the final implant. This method is highly inflexible as offensive personnel must contact researchers every time they need a final implant.
+
+2. Researchers create a binary implant template and provide a final implant generation program. Offensive personnel use this program to inject shellcode into the binary implant template, producing the final implant.
+
+The second method is the reason for the creation of PumpBin, a final implant generation program. Cybersecurity researchers only need to follow PumpBin's guidelines to write implant templates and distribute them along with PumpBin to offensive personnel. (There are very few guidelines as PumpBin is highly flexible.)