diff --git a/riscv/csrs.cc b/riscv/csrs.cc
index 0eee40de..c41323a5 100644
--- a/riscv/csrs.cc
+++ b/riscv/csrs.cc
@@ -2,6 +2,7 @@
 
 // For std::any_of
 #include <algorithm>
+#include <stdio.h>
 
 #include "csrs.h"
 // For processor_t:
@@ -82,6 +83,54 @@ bool basic_csr_t::unlogged_write(const reg_t val) noexcept {
   return true;
 }
 
+probebuffer_csr_t::probebuffer_csr_t(processor_t* const proc, const reg_t addr):
+  csr_t(proc, addr){
+    ;
+}
+
+bool probebuffer_csr_t::unlogged_write(const reg_t data) noexcept {
+  #define CMD_MASK                0xFFFF'FFFF'FFFF'0000ul
+  #define OP_MASK                 0x0000'0000'0000'FFFFul
+
+  #define CMD_SWITCH_STATE        0xAF1B'608E'883A'0000ul
+  #define STATE_DEFAULT           0
+  #define STATE_DUMP_NUM          1
+  #define STATE_DUMP_CHAR         2
+  #define STATE_DUMP_ADDR         3
+
+  #define CMD_POWER_OFF           0xAF1B'608E'883B'0000ul
+
+  switch (data & CMD_MASK) {
+        case CMD_SWITCH_STATE:
+            this->val = data & OP_MASK;
+            return true;
+        case CMD_POWER_OFF:
+            printf("[*] simulation exit with %ld\n", data & OP_MASK);
+            exit(0);
+        default:
+            break;
+    }
+
+    switch (this->val) {
+        case STATE_DEFAULT:
+            printf("[*] prober get data: %lu\n", data);
+            break;
+        case STATE_DUMP_NUM:
+            printf("%lu ", data);
+            break;
+        case STATE_DUMP_CHAR:
+            printf("%c", (char)data);
+            break;
+        case STATE_DUMP_ADDR:
+            printf("%p ", (void *)data);
+            break;
+        default:
+            break;
+    }
+
+  return true;
+}
+
 // implement class pmpaddr_csr_t
 pmpaddr_csr_t::pmpaddr_csr_t(processor_t* const proc, const reg_t addr):
   csr_t(proc, addr),
diff --git a/riscv/csrs.h b/riscv/csrs.h
index efa7f10a..da29a865 100644
--- a/riscv/csrs.h
+++ b/riscv/csrs.h
@@ -84,6 +84,20 @@ class basic_csr_t: public csr_t {
   reg_t val;
 };
 
+// For probebuffer
+class probebuffer_csr_t: public csr_t {
+ public:
+  probebuffer_csr_t(processor_t* const proc, const reg_t addr);
+
+  virtual reg_t read() const noexcept override{
+    return 0;
+  }
+ protected:
+  virtual bool unlogged_write(const reg_t val) noexcept override;
+ private:
+  reg_t val;
+};
+
 class pmpaddr_csr_t: public csr_t {
  public:
   pmpaddr_csr_t(processor_t* const proc, const reg_t addr);
diff --git a/riscv/encoding.h b/riscv/encoding.h
index a7e2d945..c2308467 100644
--- a/riscv/encoding.h
+++ b/riscv/encoding.h
@@ -3009,6 +3009,7 @@
 #define MATCH_ZUNPKD832 0xad700077
 #define MASK_ZUNPKD832 0xfff0707f
 
+#define CSR_PROBEBUFFER 0x800
 #define CSR_FFLAGS 0x1
 #define CSR_FRM 0x2
 #define CSR_FCSR 0x3
diff --git a/riscv/processor.cc b/riscv/processor.cc
index 51c9bd88..0afd79c8 100644
--- a/riscv/processor.cc
+++ b/riscv/processor.cc
@@ -322,6 +322,8 @@ void state_t::reset(processor_t* const proc, reg_t max_isa)
     1              // shiftamt
   );
 
+  csrmap[CSR_PROBEBUFFER] = std::make_shared<probebuffer_csr_t>(proc,CSR_PROBEBUFFER);
+
   auto nonvirtual_sip = std::make_shared<mip_proxy_csr_t>(proc, CSR_SIP, sip_sie_accr);
   auto vsip = std::make_shared<mip_proxy_csr_t>(proc, CSR_VSIP, vsip_vsie_accr);
   csrmap[CSR_VSIP] = vsip;