diff --git a/.travis.yml b/.travis.yml
index 3e01f13..4fb4081 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,5 +1,6 @@
 language: go
 install:
+  - go get github.com/cyfdecyf/leakybuf
   - mkdir -p $GOPATH/src/github.com/shadowsocks/shadowsocks-go/shadowsocks
   - mv * $GOPATH/src/github.com/shadowsocks/shadowsocks-go
   - pushd $GOPATH/src/github.com/shadowsocks/shadowsocks-go
@@ -8,6 +9,5 @@ install:
   - popd
 script:
   - pushd $GOPATH/src/github.com/shadowsocks/shadowsocks-go
-  - PATH=$PATH:$GOPATH/bin/ bash -x ./testscript/test.sh
+  - PATH=$PATH:$GOPATH/bin/ bash -x ./script/test.sh
   - popd
-
diff --git a/CHANGELOG b/CHANGELOG
index 1084747..f87e98e 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,8 @@
+0.6.1 (2013-03-04)
+    * Small performance improvement
+    * For windows: provide shadowsocks-tray.exe to hide shadowsocks-local.exe in
+      system tray. (Thanks to phuslu's taskbar.)
+
 0.6 (2013-01-23)
 
     * Generate ciphers on demand (encryption table cache is removed)
diff --git a/README.md b/README.md
index 7f3bdd0..8a88392 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # shadowsocks-go
 
-Current version: 0.6 [![Build Status](https://travis-ci.org/shadowsocks/shadowsocks-go.png)](https://travis-ci.org/shadowsocks/shadowsocks-go)
+Current version: 0.6.1 [![Build Status](https://travis-ci.org/shadowsocks/shadowsocks-go.png)](https://travis-ci.org/shadowsocks/shadowsocks-go)
 
 shadowsocks-go is a lightweight tunnel proxy which can help you get through firewalls. It is a port of [shadowsocks](https://github.com/clowwindy/shadowsocks).
 
diff --git a/cmd/shadowsocks-server/server.go b/cmd/shadowsocks-server/server.go
index 7fe371d..0d56dc8 100644
--- a/cmd/shadowsocks-server/server.go
+++ b/cmd/shadowsocks-server/server.go
@@ -14,7 +14,6 @@ import (
 	"runtime"
 	"strconv"
 	"sync"
-	"sync/atomic"
 	"syscall"
 )
 
@@ -83,13 +82,13 @@ func getRequest(conn *ss.Conn) (host string, extra []byte, err error) {
 
 const logCntDelta = 100
 
-var connCnt int32
-var nextLogConnCnt int32 = logCntDelta
+var connCnt int
+var nextLogConnCnt int = logCntDelta
 
 func handleConnection(conn *ss.Conn) {
 	var host string
 
-	atomic.AddInt32(&connCnt, 1)
+	connCnt++ // this maybe not accurate, but should be enough
 	if connCnt-nextLogConnCnt >= 0 {
 		// XXX There's no xadd in the atomic package, so it's difficult to log
 		// the message only once with low cost. Also note nextLogConnCnt maybe
@@ -108,7 +107,7 @@ func handleConnection(conn *ss.Conn) {
 		if debug {
 			debug.Printf("closed pipe %s<->%s\n", conn.RemoteAddr(), host)
 		}
-		atomic.AddInt32(&connCnt, -1)
+		connCnt--
 		if !closed {
 			conn.Close()
 		}
diff --git a/deb/DEBIAN/control b/deb/DEBIAN/control
index b7617a4..ce9cae2 100644
--- a/deb/DEBIAN/control
+++ b/deb/DEBIAN/control
@@ -1,5 +1,5 @@
 Package: shadowsocks-go
-Version: 0.6-1
+Version: 0.6.1-1
 Section: net
 Priority: optional
 Architecture: any
diff --git a/script/build.sh b/script/build.sh
new file mode 100755
index 0000000..c616c6a
--- /dev/null
+++ b/script/build.sh
@@ -0,0 +1,50 @@
+#!/bin/bash
+
+cd "$( dirname "${BASH_SOURCE[0]}" )/.."
+
+version=`grep 'const version = ' ./shadowsocks/util.go | sed -e 's/.*= //' | sed -e 's/"//g'`
+echo "creating shadowsocks binary version $version"
+
+export CGO_ENABLED=0
+
+ROOT=`pwd`
+bindir=$ROOT/bin
+mkdir -p $bindir
+
+build() {
+    local name
+    local GOOS
+    local GOARCH
+
+    prog=shadowsocks-$4
+    pushd cmd/$prog
+    name=$prog-$3-$version
+    echo "building $name"
+    GOOS=$1 GOARCH=$2 go build -a || exit 1
+    if [[ $1 == "windows" ]]; then
+        mv $prog.exe $ROOT/script/
+        pushd $ROOT/script/
+        zip $name.zip $prog.exe shadowsocks-tray.exe
+        rm -f $prog.exe
+        mv $name.zip $bindir
+        popd
+    else
+        mv $prog $name
+        gzip -f $name
+        mv $name.gz $bindir
+    fi
+    popd
+}
+
+build darwin amd64 mac64 local
+build linux amd64 linux64 local
+build linux 386 linux32 local
+build windows amd64 win64 local
+build windows 386 win32 local
+
+#build darwin amd64 mac64 server
+#build linux amd64 linux64 server
+#build linux 386 linux32 server
+#build windows amd64 win64 server
+#build windows 386 win32 server
+
diff --git a/createdeb.sh b/script/createdeb.sh
similarity index 76%
rename from createdeb.sh
rename to script/createdeb.sh
index 8ccd88a..9818389 100755
--- a/createdeb.sh
+++ b/script/createdeb.sh
@@ -1,5 +1,8 @@
 #!/bin/bash
 
+cd "$( dirname "${BASH_SOURCE[0]}" )/.."
+ver=$(awk '/\tconst version =/ { print $4 }' shadowsocks/util.go | sed -e 's/"//g')
+
 if [[ $# != 1 ]]; then
     echo "$0 <arch, i386 or amd64>"
     exit 1
@@ -28,7 +31,7 @@ go build -a -v || exit 1
 popd
 
 # create debian package
-DEBDIR=shadowsocks-go_0.6-1-$arch
+DEBDIR=shadowsocks-go_$ver-1-$arch
 rm -rf $DEBDIR
 cp -r deb $DEBDIR
 
@@ -36,6 +39,7 @@ sed -i -e "s/^Architecture.*$/Architecture: $arch/" $DEBDIR/DEBIAN/control || ex
 
 mkdir -p $DEBDIR/usr/bin
 cp cmd/shadowsocks-server/shadowsocks-server $DEBDIR/usr/bin/shadowsocks
+rm -f cmd/shadowsocks-server/shadowsocks-server
 
 fakeroot dpkg-deb --build $DEBDIR
 
diff --git a/testscript/curl.sh b/script/curl.sh
similarity index 100%
rename from testscript/curl.sh
rename to script/curl.sh
diff --git a/script/shadowsocks-tray.exe b/script/shadowsocks-tray.exe
new file mode 100755
index 0000000..bcf285f
Binary files /dev/null and b/script/shadowsocks-tray.exe differ
diff --git a/testscript/test.sh b/script/test.sh
similarity index 100%
rename from testscript/test.sh
rename to script/test.sh
diff --git a/win32build.bat b/script/win32build.bat
similarity index 100%
rename from win32build.bat
rename to script/win32build.bat
diff --git a/shadowsocks/encrypt.go b/shadowsocks/encrypt.go
index ad3b0ce..960436d 100644
--- a/shadowsocks/encrypt.go
+++ b/shadowsocks/encrypt.go
@@ -8,6 +8,8 @@ import (
 	"errors"
 )
 
+var errEmptyKey = errors.New("empty key")
+
 type Cipher interface {
 	// Some ciphers maintains context (e.g. RC4), which means different
 	// connections need to use their own ciphers. Copy() will create an copy
@@ -27,6 +29,9 @@ type TableCipher struct {
 
 // Creates a new table based cipher. err is always nil.
 func NewTableCipher(key string) (c Cipher, err error) {
+	if key == "" {
+		return nil, errEmptyKey
+	}
 	const tbl_size = 256
 	tbl := TableCipher{
 		make([]byte, tbl_size),
@@ -83,6 +88,9 @@ type RC4Cipher struct {
 }
 
 func NewRC4Cipher(key string) (c Cipher, err error) {
+	if key == "" {
+		return nil, errEmptyKey
+	}
 	h := md5.New()
 	h.Write([]byte(key))
 	enc, err := rc4.NewCipher(h.Sum(nil))
diff --git a/shadowsocks/pipe.go b/shadowsocks/pipe.go
index f22f35f..f41ce8f 100644
--- a/shadowsocks/pipe.go
+++ b/shadowsocks/pipe.go
@@ -2,6 +2,7 @@ package shadowsocks
 
 import (
 	// "io"
+	"github.com/cyfdecyf/leakybuf"
 	"net"
 	"time"
 )
@@ -17,10 +18,16 @@ func SetReadTimeout(c net.Conn) {
 	}
 }
 
+const bufSize = 4096
+const nBuf = 2048
+
+var pipeBuf = leakybuf.NewLeakyBuf(nBuf, bufSize)
+
 // PipeThenClose copies data from src to dst, closes dst when done.
 func PipeThenClose(src, dst net.Conn, timeoutOpt int) {
 	defer dst.Close()
-	buf := make([]byte, 4096)
+	buf := pipeBuf.Get()
+	defer pipeBuf.Put(buf)
 	for {
 		if timeoutOpt == SET_TIMEOUT {
 			SetReadTimeout(src)
diff --git a/shadowsocks/util.go b/shadowsocks/util.go
index 04c7f82..95ba7e1 100644
--- a/shadowsocks/util.go
+++ b/shadowsocks/util.go
@@ -7,7 +7,7 @@ import (
 )
 
 func PrintVersion() {
-	const version = "0.6"
+	const version = "0.6.1"
 	fmt.Println("shadowsocks-go version", version)
 }