diff --git a/nemu/scripts/build.mk b/nemu/scripts/build.mk
index b3ba734..f050197 100644
--- a/nemu/scripts/build.mk
+++ b/nemu/scripts/build.mk
@@ -10,7 +10,7 @@ endif
 WORK_DIR  = $(shell pwd)
 BUILD_DIR = $(WORK_DIR)/build
 
-INC_PATH := $(WORK_DIR)/include $(INC_PATH)
+INC_PATH := $(WORK_DIR)/include $(BUILD_DIR)/include $(INC_PATH)
 OBJ_DIR  = $(BUILD_DIR)/obj-$(NAME)$(SO)
 BINARY   = $(BUILD_DIR)/$(NAME)$(SO)
 
@@ -42,13 +42,13 @@ $(OBJ_DIR)/%.o: %.cc
 
 $(OBJ_DIR)/%.tag.c: %.y
 	@echo + YACC $<
-	@mkdir -p $(dir $@)
-	@$(YACC) $(YFLAGS) --header=$(<:.y=.h) -o $@ $<
+	@mkdir -p $(dir $@) $(BUILD_DIR)/include
+	@$(YACC) $(YFLAGS) --header=$(BUILD_DIR)/include/$(notdir $(<:.y=.h)) -o $@ $<
 
 $(OBJ_DIR)/%.yy.c: %.l $(OBJ_DIR)/%.tag.c
 	@echo + LEX $<
-	@mkdir -p $(dir $@)
-	@$(LEX) $(LFLAGS) --header=$(<:.l=_lex.h) -o $@ $<
+	@mkdir -p $(dir $@) $(BUILD_DIR)/include
+	@$(LEX) $(LFLAGS) --header=$(BUILD_DIR)/include/$(notdir $(<:.l=_lex.h)) -o $@ $<
 
 $(OBJ_DIR)/%.tag.o: $(OBJ_DIR)/%.tag.c
 	@echo + CC $<
@@ -67,7 +67,7 @@ $(OBJ_DIR)/%.yy.o: $(OBJ_DIR)/%.yy.c
 
 # Some convenient rules
 
-.PHONY: app clean
+.PHONY: app install clean
 
 app: $(BINARY)
 
@@ -75,5 +75,9 @@ $(BINARY):: $(OBJS) $(ARCHIVES)
 	@echo + LD $@
 	@$(LD) -o $@ $(OBJS) $(LDFLAGS) $(ARCHIVES) $(LIBS)
 
+install: $(BINARY)
+	@mkdir -p $(PREFIX)/bin
+	@cp $(BINARY) $(PREFIX)/bin/
+
 clean:
 	-rm -rf $(BUILD_DIR)
diff --git a/nemu/src/monitor/sdb/filelist.mk b/nemu/src/monitor/sdb/filelist.mk
index 394a8a3..f477a4f 100644
--- a/nemu/src/monitor/sdb/filelist.mk
+++ b/nemu/src/monitor/sdb/filelist.mk
@@ -1,3 +1,2 @@
 SRCS-y += src/monitor/sdb/addrexp.tag.c src/monitor/sdb/addrexp.yy.c
-INC_PATH += src/monitor/sdb
 LFLAGS += -DYY_NO_UNPUT -DYY_NO_INPUT
diff --git a/nemu/src/monitor/sdb/sdb.c b/nemu/src/monitor/sdb/sdb.c
index 82b39b0..1212193 100644
--- a/nemu/src/monitor/sdb/sdb.c
+++ b/nemu/src/monitor/sdb/sdb.c
@@ -19,7 +19,7 @@
 #include <cpu/cpu.h>
 #include <errno.h>
 #include <isa.h>
-#include <memory/paddr.h>
+#include <memory/vaddr.h>
 #include <readline/history.h>
 #include <readline/readline.h>
 #include <stdint.h>
@@ -125,17 +125,13 @@ static word_t parse_uint(const char *arg, bool *success) {
   }
 }
 
-static paddr_t parse_expr(const char *arg, bool *success) {
+static vaddr_t parse_expr(const char *arg, bool *success) {
   if (arg == NULL) {
     puts("Invalid expr argument.");
     *success = false;
     return 0;
   } else {
-    // bool res = false;
-    // FIXME: We cannot use `parse_uint` here, it accept `-1234` as input
-    // paddr_t addr = parse_uint(arg, &res);
-    // *success = res;
-    paddr_t addr;
+    vaddr_t addr;
     yy_scan_string(arg);
     *success = !yyparse(&addr);
     yylex_destroy();
@@ -193,15 +189,15 @@ static int cmd_x(char *args) {
     goto wrong_usage;
   // No deliminter here, just pass all the remain argument to `parse_expr()`
   arg = strtok(NULL, "");
-  word_t addr = parse_expr(arg, &res);
+  word_t start_addr = parse_expr(arg, &res);
   if (!res)
     goto wrong_usage;
-  addr = addr & ~(WORD_BYTES - 1);
-  for (paddr_t paddr = addr; paddr < addr + n; paddr += WORD_BYTES) {
-    word_t value = paddr_read(addr, WORD_BYTES);
+  start_addr = start_addr & ~(WORD_BYTES - 1);
+  for (vaddr_t vaddr = start_addr; vaddr < start_addr + n; vaddr += WORD_BYTES) {
+    word_t value = vaddr_read(vaddr, WORD_BYTES);
     printf("\e[1;34m" FMT_PADDR "\e[0m"
            "  " FMT_WORD "\n",
-           paddr, value);
+           vaddr, value);
   }
   return 0;