diff --git a/blix.nix b/blix.nix
index e6f1a54..83b3006 100644
--- a/blix.nix
+++ b/blix.nix
@@ -60,7 +60,7 @@ with lib;
     wget vim tmux gnupg ncdu mosh
     git curl rsync wireguard-tools
     w3m lynx elinks ungoogled-chromium
-    inetutils dnsutils dnsx whois
+    inetutils dnsutils dnsx whois jo jq
 
     # network analysis
     nmap masscan wireshark wireshark-qt termshark netsniff-ng argus
@@ -77,7 +77,7 @@ with lib;
     stegseek apktool adbfs-rootless ursadb android-udev-rules
     valgrind dos2unix file exiftool foremost pngcheck ccrypt
     docker xcd trufflehog sleuthkit radare2 radare2-cutter
-    clamav spyre # volatility
+    clamav spyre snowman # volatility
 
     # exploit
     doona metasploit twa wifite2 burpsuite wpscan wfuzz
diff --git a/manuals/blix-applications.7 b/manuals/blix-applications.7
index 9699bd1..42f9f8f 100644
--- a/manuals/blix-applications.7
+++ b/manuals/blix-applications.7
@@ -105,6 +105,8 @@ copy data from dying disk
 identify and classify malware
 .It spyre
 IOC scanner
+.It snowman
+C/C++ decompiler
 .\".It volatility
 .\"memory forsenics framework
 .It stegseek