diff --git a/docs/zh/docs/pwn/linux/user-mode/heap/ptmalloc2/house-of-lore.md b/docs/zh/docs/pwn/linux/user-mode/heap/ptmalloc2/house-of-lore.md
index af69f352a2..4e529e98ee 100644
--- a/docs/zh/docs/pwn/linux/user-mode/heap/ptmalloc2/house-of-lore.md
+++ b/docs/zh/docs/pwn/linux/user-mode/heap/ptmalloc2/house-of-lore.md
@@ -184,4 +184,4 @@ int main(int argc, char * argv[]){
 
 ## 参考文献
 
-- [https://github.com/shellphish/how2heap/blob/master/glibc_2.25/house_of_lore.c](https://github.com/shellphish/how2heap/blob/master/glibc_2.25/house_of_lore.c)
\ No newline at end of file
+- [https://github.com/shellphish/how2heap/blob/master/glibc_2.27/house_of_lore.c](https://github.com/shellphish/how2heap/blob/master/glibc_2.27/house_of_lore.c)
\ No newline at end of file
diff --git a/docs/zh/docs/pwn/linux/user-mode/heap/ptmalloc2/tcache-attack.md b/docs/zh/docs/pwn/linux/user-mode/heap/ptmalloc2/tcache-attack.md
index 48eaa38032..2e277c5fd2 100644
--- a/docs/zh/docs/pwn/linux/user-mode/heap/ptmalloc2/tcache-attack.md
+++ b/docs/zh/docs/pwn/linux/user-mode/heap/ptmalloc2/tcache-attack.md
@@ -734,7 +734,7 @@ tcache_put (mchunkptr chunk, size_t tc_idx)
 
 因为没有任何检查，所以我们可以对同一个 chunk 多次 free，造成 cycliced list。
 
-以 how2heap 的 [tcache_dup](https://github.com/shellphish/how2heap/blob/master/glibc_2.26/tcache_dup.c) 为例分析，源码如下：
+以 how2heap 的 [tcache_dup](https://github.com/shellphish/how2heap/blob/master/glibc_2.27/tcache_dup.c) 为例分析，源码如下：
 ```C
 glibc_2.26 [master●] bat ./tcache_dup.c 
 ───────┬─────────────────────────────────────────────────────────────────────────────────
diff --git a/docs/zh/docs/pwn/linux/user-mode/heap/ptmalloc2/unsorted-bin-attack.md b/docs/zh/docs/pwn/linux/user-mode/heap/ptmalloc2/unsorted-bin-attack.md
index 1fdabe2e39..302e5e923b 100644
--- a/docs/zh/docs/pwn/linux/user-mode/heap/ptmalloc2/unsorted-bin-attack.md
+++ b/docs/zh/docs/pwn/linux/user-mode/heap/ptmalloc2/unsorted-bin-attack.md
@@ -113,7 +113,7 @@ main_arena_offset = ELF("libc.so.6").symbols["__malloc_hook"] + 0x10
 
 
 
-这里我以 shellphish 的 how2heap 仓库中的 [unsorted_bin_attack.c](https://github.com/shellphish/how2heap/blob/master/unsorted_bin_attack.c) 为例进行介绍，这里我做一些简单的修改，如下
+这里我以 shellphish 的 how2heap 仓库中的 [unsorted_bin_attack.c](https://github.com/shellphish/how2heap/blob/master/glibc_2.27/unsorted_bin_attack.c) 为例进行介绍，这里我做一些简单的修改，如下
 
 ```c
 #include <stdio.h>