diff --git a/Firmware/src/app.c b/Firmware/src/app.c
index c781ea6..d464be1 100644
--- a/Firmware/src/app.c
+++ b/Firmware/src/app.c
@@ -39,18 +39,6 @@ void user_init_normal(void)
     battery_mv = get_battery_mv();
     battery_level = get_battery_level(battery_mv);
     epd_display_tiff();
-
-    // image[1 * epd_height/8 + 0] = 0xff;
-    // image[1 * epd_height/8 + 1] = 0xff;
-    // image[1 * epd_height/8 + 2] = 0xff;
-    // image[1 * epd_height/8 + 3] = 0xff;
-
-    // Rectangle in the middle of the screen.
-    for (int x = 0; x < 50; x++) {
-      for (int y = 0; y < 12; y++) {
-        image[(x + 100) * epd_height / 8 + y + 2] = 0xff;
-      }
-    }
     EPD_Display(image, sizeof(image));
 }
 
diff --git a/Firmware/src/app_att.c b/Firmware/src/app_att.c
index 9daeb71..562b9b5 100644
--- a/Firmware/src/app_att.c
+++ b/Firmware/src/app_att.c
@@ -157,44 +157,6 @@ extern int otaWritePre(void * p);
 extern int otaReadPre(void * p);
 extern int RxTxWrite(void * p);
 
-unsigned char image[epd_buffer_size];
-unsigned int byte_pos = 0;
-
-int epd_ble_handle_write2(void * p) {
-	rf_packet_att_write_t *req = (rf_packet_att_write_t*)p;
-	uint8_t *payload = &req->value;
-	unsigned int payload_len = req->l2capLen - 3;
-
-	switch (payload[0]) {
-		// Clear EPD display.
-		case 0x00:
-			memset(image, payload[1], sizeof(image));
-			break;
-		// Push buffer to display.
-		case 0x01:
-			EPD_Display(image, epd_buffer_size);
-			break;
-		// Set byte_pos.
-		case 0x02:
-			byte_pos = payload[1] << 8 | payload[2];
-			break;
-		// Write data to image buffer.
-		case 0x03:
-			memcpy(image + byte_pos, payload + 1, payload_len - 1);
-			byte_pos += payload_len - 1;
-			break;
-		// Push image buffer to display.
-		case 0x04:
-			EPD_Display(image, sizeof(image));
-			break;
-		default:
-			return -1;
-	}
-
-	return 0;
-}
-
-
 // TM : to modify
 static const attribute_t my_Attributes[] = {
 	{ATT_END_H - 1, 0,0,0,0,0},	// total num of attribute
@@ -236,9 +198,9 @@ static const attribute_t my_Attributes[] = {
 	{0,ATT_PERMISSIONS_WRITE, 2,sizeof(my_RxTx_Data),(u8*)(&my_RxTxUUID),	(&my_RxTx_Data), &RxTxWrite},			//value
 	{0,ATT_PERMISSIONS_RDWR,2,sizeof(RxTxValueInCCC),(u8*)(&clientCharacterCfgUUID), 	(u8*)(RxTxValueInCCC), 0},	//value
 	////////////////////////////////////// EPD_BLE ////////////////////////////////////////////////////
-	{4,ATT_PERMISSIONS_READ, 2,2,(u8*)(&my_primaryServiceUUID), 	(u8*)(&my_EPD_BLE_ServiceUUID), 0},
-	{0,ATT_PERMISSIONS_READ, 2, sizeof(my_EPD_BLECharVal),(u8*)(&my_characterUUID), (u8*)(my_EPD_BLECharVal), 0},				//prop
-	{0,ATT_PERMISSIONS_WRITE, 2,sizeof(my_EPD_BLE_Data),(u8*)(&my_EPD_BLEUUID),	(&my_EPD_BLE_Data), (att_readwrite_callback_t) &epd_ble_handle_write2},			//value
+	{3,ATT_PERMISSIONS_READ, 2,2,(u8*)(&my_primaryServiceUUID), 	(u8*)(&my_EPD_BLE_ServiceUUID), 0},
+	{0,ATT_PERMISSIONS_READ, 2, sizeof(my_EPD_BLECharVal),(u8*)(&my_characterUUID), (u8*)(my_EPD_BLECharVal), 0},
+	{0,ATT_PERMISSIONS_WRITE, 2,sizeof(my_EPD_BLE_Data),(u8*)(&my_EPD_BLEUUID),	(&my_EPD_BLE_Data), (att_readwrite_callback_t) &epd_ble_handle_write},
 };
 
 void my_att_init(void)
diff --git a/Firmware/src/epd_ble_service.c b/Firmware/src/epd_ble_service.c
index dc4ff7d..1f38949 100644
--- a/Firmware/src/epd_ble_service.c
+++ b/Firmware/src/epd_ble_service.c
@@ -6,58 +6,47 @@
 
 #include "epd.h"
 
-static uint8_t image[epd_buffer_size];
-static unsigned int byte_pos = 0;
+#define ASSERT_MIN_LEN(val, min_len)  \
+	if (val < min_len) {		  					\
+		return 0; 												\
+	}
+
+unsigned char image[epd_buffer_size];
+unsigned int byte_pos = 0;
 
 int epd_ble_handle_write(void * p) {
-	rf_packet_att_write_t *req = (rf_packet_att_write_t*)p;
-	uint8_t *payload = (uint8_t *) &req->value;
+	rf_packet_att_write_t *req = (rf_packet_att_write_t*) p;
+	uint8_t *payload = &req->value;
 	unsigned int payload_len = req->l2capLen - 3;
 
-	// switch (payload[0]) {
-	// 	// Clear EPD display.
-	// 	case 0x00:
-	// 		memset(image, payload[1], sizeof(image));
-	// 		break;
-	// 	// Push buffer to display.
-	// 	case 0x01:
-	// 		EPD_Display(image, sizeof(image));
-	// 		break;
-	// 	// Set byte_pos.
-	// 	case 0x02:
-	// 		byte_pos = payload[1] << 8 | payload[2];
-	// 		break;
-	// 	// Write data to image buffer.
-	// 	case 0x03:
-	// 		memcpy(image + byte_pos, payload + 1, payload_len - 1);
-	// 		byte_pos += payload_len - 1;
-	// 		break;
-	// 	// Push image buffer to display.
-	// 	case 0x04:
-	// 		EPD_Display(image, sizeof(image));
-	// 		break;
-	// 	default:
-	// 		return -1;
-	// }
+	ASSERT_MIN_LEN(payload_len, 1);
 
-	// char buf[64];
-	// sprintf(buf, "Size: %d\n", req->l2capLen);
-	// uart_write(buf);
-	// uint8_t *v = &req->value;
-	// memcpy(image + byte_pos, (uint8_t *) &req->value, req->l2capLen - 3);
-	// byte_pos += req->l2capLen - 3;
+	switch (payload[0]) {
+		// Clear EPD display.
+		case 0x00:
+			ASSERT_MIN_LEN(payload_len, 2);
+			memset(image, payload[1], sizeof(image));
+			return 0;
+		// Push buffer to display.
+		case 0x01:
+			EPD_Display(image, epd_buffer_size);
+			return 0;
+		// Set byte_pos.
+		case 0x02:
+			ASSERT_MIN_LEN(payload_len, 3);
+			byte_pos = payload[1] << 8 | payload[2];
+			return 0;
+		// Write data to image buffer.
+		case 0x03:
+			if (byte_pos + payload_len - 1 >= sizeof(image)) {
+				return 0;
+			}
+			memcpy(image + byte_pos, payload + 1, payload_len - 1);
+			byte_pos += payload_len - 1;
+			return 0;
+		default:
+			return 0;
+	}
 
-	// if (byte_pos > 2047) {
-	// 	EPD_Display(image, epd_buffer_size);
-	// 	memset(image, 0xff, epd_buffer_size);
-	// 	byte_pos = 0;
-	// }
-	// for (int i = 0; i < 20; i++) {
-	// 	// sprintf(buf, "0x%02x ", req->dat[i]);
-	// 	sprintf(buf, "0x%02x ", *(v + i));
-	// 	uart_write(buf);
-	// }
-	// uart_write("\n");
-	// return 0;
 	return 0;
-}
+}
\ No newline at end of file