Update README.md

README.md

@@ -218,6 +218,8 @@ options:
 
 ## New Memory Guard
 
+<img width="400" alt="Sifu" src="https://github.com/user-attachments/assets/935ee41b-02cd-46dc-8d29-2fd67d365b7f">
+
 ### Introduction
 
 Due to the prevalence of Kernel PatchGuard, System Service Descriptor Table (SSDT) hooking has become less popular among AV companies. Userland hooks and kernel callback inspection are the two main methods adopted by contemporary AVs.
@@ -244,7 +246,6 @@ Marcus proposed using hardware breakpoints to set up the function arguments at t
 
 
 ### New Memory Guard Family: 
-<img width="400" alt="Sifu" src="https://github.com/user-attachments/assets/935ee41b-02cd-46dc-8d29-2fd67d365b7f">
 
 The aim is to make the shellcode "non-exist" to the AV as long as possible except when it is executed in a thread.