diff --git a/CMakeLists.txt b/CMakeLists.txt
index d89cd52b..ca84604e 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1026,7 +1026,7 @@ endif()
 #
 set(CPACK_PACKAGE_NAME "GmSSL")
 set(CPACK_PACKAGE_VENDOR "GmSSL develop team")
-set(CPACK_PACKAGE_VERSION "3.3.0-dev.1173")
+set(CPACK_PACKAGE_VERSION "3.3.0-dev.1174")
 set(CPACK_PACKAGE_DESCRIPTION_FILE ${PROJECT_SOURCE_DIR}/README.md)
 set(CPACK_NSIS_MODIFY_PATH ON)
 include(CPack)
diff --git a/cmake/tool_helpers.cmake b/cmake/tool_helpers.cmake
index 1eb4c678..8346a74d 100644
--- a/cmake/tool_helpers.cmake
+++ b/cmake/tool_helpers.cmake
@@ -25,6 +25,18 @@ function(gmssl_run_capture out_var)
 	set(${out_var} "${TEST_STDOUT}" PARENT_SCOPE)
 endfunction()
 
+function(gmssl_expect_fail)
+	execute_process(
+		COMMAND ${GMSSL_BIN} ${ARGN}
+		RESULT_VARIABLE TEST_RESULT
+		ERROR_VARIABLE TEST_STDERR
+		OUTPUT_VARIABLE TEST_STDOUT
+	)
+	if(TEST_RESULT EQUAL 0)
+		message(FATAL_ERROR "command unexpectedly succeeded: ${GMSSL_BIN} ${ARGN}\nstderr: ${TEST_STDERR}\nstdout: ${TEST_STDOUT}")
+	endif()
+endfunction()
+
 function(gmssl_expect_stdout expected)
 	gmssl_run_capture(TEST_STDOUT ${ARGN})
 	if(NOT TEST_STDOUT STREQUAL "${expected}")
diff --git a/cmake/tool_sm4.cmake b/cmake/tool_sm4.cmake
index f5efb65b..243be8a9 100644
--- a/cmake/tool_sm4.cmake
+++ b/cmake/tool_sm4.cmake
@@ -17,11 +17,29 @@ file(WRITE tool_sm4_cbc_kat.plain "0123456789abcdef")
 gmssl_run(sm4_cbc -encrypt -key ${SM4_KEY} -iv ${SM4_IV}
 	-in tool_sm4_cbc_kat.plain -out tool_sm4_cbc_kat.cipher)
 gmssl_expect_file_hex(tool_sm4_cbc_kat.cipher
-	"e6887b77dbabb572ffa07fed7548b192ceaace11f2b90b94c2b7a4d9382e471e")
+	"e6887b77dbabb572ffa07fed7548b192")
 gmssl_run(sm4_cbc -decrypt -key ${SM4_KEY} -iv ${SM4_IV}
 	-in tool_sm4_cbc_kat.cipher -out tool_sm4_cbc_kat.decrypt)
 gmssl_files_equal(tool_sm4_cbc_kat.plain tool_sm4_cbc_kat.decrypt)
 
+file(WRITE tool_sm4_cbc_short.plain "abc")
+gmssl_expect_fail(sm4_cbc -encrypt -key ${SM4_KEY} -iv ${SM4_IV}
+	-in tool_sm4_cbc_short.plain -out tool_sm4_cbc_short.cipher)
+gmssl_run(sm4_cbc -encrypt -pkcs7_padding -key ${SM4_KEY} -iv ${SM4_IV}
+	-in tool_sm4_cbc_short.plain -out tool_sm4_cbc_short_pkcs7.cipher)
+gmssl_run(sm4_cbc -decrypt -pkcs7_padding -key ${SM4_KEY} -iv ${SM4_IV}
+	-in tool_sm4_cbc_short_pkcs7.cipher -out tool_sm4_cbc_short_pkcs7.decrypt)
+gmssl_files_equal(tool_sm4_cbc_short.plain tool_sm4_cbc_short_pkcs7.decrypt)
+
+file(WRITE tool_sm4_cbc_pkcs7_kat.plain "0123456789abcdef")
+gmssl_run(sm4_cbc -encrypt -pkcs7_padding -key ${SM4_KEY} -iv ${SM4_IV}
+	-in tool_sm4_cbc_pkcs7_kat.plain -out tool_sm4_cbc_pkcs7_kat.cipher)
+gmssl_expect_file_hex(tool_sm4_cbc_pkcs7_kat.cipher
+	"e6887b77dbabb572ffa07fed7548b192ceaace11f2b90b94c2b7a4d9382e471e")
+gmssl_run(sm4_cbc -decrypt -pkcs7_padding -key ${SM4_KEY} -iv ${SM4_IV}
+	-in tool_sm4_cbc_pkcs7_kat.cipher -out tool_sm4_cbc_pkcs7_kat.decrypt)
+gmssl_files_equal(tool_sm4_cbc_pkcs7_kat.plain tool_sm4_cbc_pkcs7_kat.decrypt)
+
 file(WRITE tool_sm4_unified_cbc_kat.plain "0123456789abcdef")
 gmssl_run(sm4 -cbc -encrypt -key ${SM4_KEY} -iv ${SM4_IV}
 	-in tool_sm4_unified_cbc_kat.plain -out tool_sm4_unified_cbc_kat.cipher)
@@ -32,6 +50,7 @@ gmssl_run(sm4 -cbc -decrypt -key ${SM4_KEY} -iv ${SM4_IV}
 gmssl_files_equal(tool_sm4_unified_cbc_kat.plain tool_sm4_unified_cbc_kat.decrypt)
 
 gmssl_symmetric_roundtrip(tool_sm4_cbc sm4_cbc -key ${SM4_KEY} -iv ${SM4_IV})
+gmssl_symmetric_roundtrip(tool_sm4_cbc_pkcs7 sm4_cbc -pkcs7_padding -key ${SM4_KEY} -iv ${SM4_IV})
 gmssl_symmetric_roundtrip(tool_sm4_ctr sm4_ctr -key ${SM4_KEY} -iv ${SM4_IV})
 gmssl_symmetric_roundtrip(tool_sm4_gcm sm4_gcm -key ${SM4_KEY} -iv 000000000000000000000000 -aad_hex 001122 -taglen 16)
 
diff --git a/cmake/tool_zuc.cmake b/cmake/tool_zuc.cmake
index 9c741167..10cecb9b 100644
--- a/cmake/tool_zuc.cmake
+++ b/cmake/tool_zuc.cmake
@@ -12,13 +12,13 @@ gmssl_files_equal(tool_zuc.plain tool_zuc.decrypt)
 gmssl_run(zuc_128_eea3
 	-key 173d14ba5003731d7a60049470f00a29
 	-count 0x66035492 -bearer 15 -direction 0
-	-in_hex 6cf65340735552ab0c9752fa6f9025fe0bd675d9005875b2
+	-in tool_zuc.plain
 	-out tool_zuc_128_eea3.cipher)
 gmssl_expect_file_hex(tool_zuc_128_eea3.cipher
-	"a6c85fc66afb8533aafc2518dfe784940ee1e4b030238cc8")
-gmssl_expect_stdout("390a91b7\n" zuc_128_eia3
+	"fa0f3eb52d9be1af9e521680d313c40c")
+gmssl_expect_stdout("b0361765\n" zuc_128_eia3
 	-key 00000000000000000000000000000000
-	-count 0 -bearer 0 -direction 0 -in_hex 00)
+	-count 0 -bearer 0 -direction 0 -in tool_zuc.plain)
 
 gmssl_run(zuc256
 	-key 0000000000000000000000000000000000000000000000000000000000000000
diff --git a/include/gmssl/version.h b/include/gmssl/version.h
index 0989552a..d893c479 100644
--- a/include/gmssl/version.h
+++ b/include/gmssl/version.h
@@ -18,7 +18,7 @@ extern "C" {
 
 
 #define GMSSL_VERSION_NUM	30300
-#define GMSSL_VERSION_STR	"GmSSL 3.3.0-dev.1173"
+#define GMSSL_VERSION_STR	"GmSSL 3.3.0-dev.1174"
 
 int gmssl_version_num(void);
 const char *gmssl_version_str(void);
diff --git a/tools/certgen.c b/tools/certgen.c
index 829b5435..7d7156e8 100644
--- a/tools/certgen.c
+++ b/tools/certgen.c
@@ -111,12 +111,12 @@ static char *usage =
 "    gmssl sm2keygen -pass P@ssw0rd -out rootcakey.pem\n"
 "\n"
 "    gmssl certgen -C CN -ST Beijing -L Haidian -O PKU -OU CS -CN ROOTCA -days 3650 \\\n"
-"          -key rootcakey.pem -pass P@ssw0rd \\\n"
-"          -ca -path_len_constraint 6 \\\n"
-"          -key_usage keyCertSign -key_usage cRLSign \\\n"
-"          -crl_http_uri http://pku.edu.cn/ca.crl \\\n"
-"          -ca_issuers_uri http://pku.edu.cn/ca.crt -ocsp_uri http://ocsp.pku.edu.cn \\\n"
-"          -out rootcacert.pem\n"
+"        -key rootcakey.pem -pass P@ssw0rd \\\n"
+"        -ca -path_len_constraint 6 \\\n"
+"        -key_usage keyCertSign -key_usage cRLSign \\\n"
+"        -crl_http_uri http://pku.edu.cn/ca.crl \\\n"
+"        -ca_issuers_uri http://pku.edu.cn/ca.crt -ocsp_uri http://ocsp.pku.edu.cn \\\n"
+"        -out rootcacert.pem\n"
 "\n";
 
 
diff --git a/tools/gmssl.c b/tools/gmssl.c
index 070cda83..9d65dbd3 100644
--- a/tools/gmssl.c
+++ b/tools/gmssl.c
@@ -160,10 +160,18 @@ static const char *options =
 	"  sm3               Generate SM3 hash\n"
 	"  sm3hmac           Generate SM3 HMAC tag\n"
 	"  sm3_pbkdf2        Hash password into key using PBKDF2 algoritm\n"
-	"  sm4               Encrypt or decrypt with SM4\n"
-	"  sm4_gcm           Encrypt or decrypt with SM4 GCM\n"
+#ifdef ENABLE_SM4_ECB
+	"  sm4_ecb           Encrypt or decrypt with SM4 ECB\n"
+#endif
 	"  sm4_cbc           Encrypt or decrypt with SM4 CBC\n"
+#ifdef ENABLE_SM4_CFB
+	"  sm4_cfb           Encrypt or decrypt with SM4 CFB\n"
+#endif
+#ifdef ENABLE_SM4_OFB
+	"  sm4_ofb           Encrypt or decrypt with SM4 OFB\n"
+#endif
 	"  sm4_ctr           Encrypt or decrypt with SM4 CTR\n"
+	"  sm4_gcm           Encrypt or decrypt with SM4 GCM\n"
 #ifdef ENABLE_SM4_CCM
 	"  sm4_ccm           Encrypt or decrypt with SM4 CCM\n"
 #endif
@@ -173,15 +181,6 @@ static const char *options =
 #ifdef ENABLE_SM4_FF1
 	"  sm4_ff1           Encrypt or decrypt digits with SM4 FF1\n"
 #endif
-#ifdef ENABLE_SM4_ECB
-	"  sm4_ecb           Encrypt or decrypt with SM4 ECB\n"
-#endif
-#ifdef ENABLE_SM4_CFB
-	"  sm4_cfb           Encrypt or decrypt with SM4 CFB\n"
-#endif
-#ifdef ENABLE_SM4_OFB
-	"  sm4_ofb           Encrypt or decrypt with SM4 OFB\n"
-#endif
 #ifdef ENABLE_SM4_CBC_MAC
 	"  sm4_cbc_mac       Generate SM4 CBC-MAC\n"
 #endif
diff --git a/tools/reqsign.c b/tools/reqsign.c
index 6e28f48e..4f45fad4 100644
--- a/tools/reqsign.c
+++ b/tools/reqsign.c
@@ -112,12 +112,12 @@ static char *usage =
 "\n"
 "    gmssl sm2keygen -pass P@ssw0rd -out rootcakey.pem\n"
 "    gmssl certgen -C CN -ST Beijing -L Haidian -O PKU -OU CS -CN ROOTCA -days 3650 \\\n"
-"          -key rootcakey.pem -pass P@ssw0rd \\\n"
-"          -ca -path_len_constraint 6 \\\n"
-"          -key_usage keyCertSign -key_usage cRLSign \\\n"
-"          -crl_http_uri http://pku.edu.cn/ca.crl \\\n"
-"          -ca_issuers_uri http://pku.edu.cn/ca.crt -ocsp_uri http://ocsp.pku.edu.cn \\\n"
-"          -out rootcacert.pem\n"
+"        -key rootcakey.pem -pass P@ssw0rd \\\n"
+"        -ca -path_len_constraint 6 \\\n"
+"        -key_usage keyCertSign -key_usage cRLSign \\\n"
+"        -crl_http_uri http://pku.edu.cn/ca.crl \\\n"
+"        -ca_issuers_uri http://pku.edu.cn/ca.crt -ocsp_uri http://ocsp.pku.edu.cn \\\n"
+"        -out rootcacert.pem\n"
 "\n"
 "    # Generate sub-CA certificate request\n"
 "\n"
@@ -127,12 +127,12 @@ static char *usage =
 "    # Sign certificate request to generate sub-CA certificate\n"
 "\n"
 "    gmssl reqsign -in careq.pem -serial_len 12 -days 365 \\\n"
-"          -cacert rootcacert.pem -key rootcakey.pem -pass P@ssw0rd \\\n"
-"          -ca -path_len_constraint 0 \\\n"
-"          -key_usage keyCertSign -key_usage cRLSign \\\n"
-"          -crl_http_uri http://pku.edu.cn/ca.crl \\\n"
-"          -ca_issuers_uri http://pku.edu.cn/ca.crt -ocsp_uri http://ocsp.pku.edu.cn \\\n"
-"          -out cacert.pem\n"
+"        -cacert rootcacert.pem -key rootcakey.pem -pass P@ssw0rd \\\n"
+"        -ca -path_len_constraint 0 \\\n"
+"        -key_usage keyCertSign -key_usage cRLSign \\\n"
+"        -crl_http_uri http://pku.edu.cn/ca.crl \\\n"
+"        -ca_issuers_uri http://pku.edu.cn/ca.crt -ocsp_uri http://ocsp.pku.edu.cn \\\n"
+"        -out cacert.pem\n"
 "\n";
 
 static int ext_key_usage_set(int *usages, const char *usage_name)
diff --git a/tools/sm2exch.c b/tools/sm2exch.c
index bf23f5f4..228c6808 100644
--- a/tools/sm2exch.c
+++ b/tools/sm2exch.c
@@ -80,36 +80,36 @@ static const char *options =
 "    gmssl sm2keygen -pass P@ssw0rd -out alice.pem -pubout alicepub.pem\n"
 "    gmssl sm2keygen -pass P@ssw0rd -out bob.pem -pubout bobpub.pem\n"
 "    gmssl sm2exch -stage init \\\n"
-"          -exch_keyout alice_ra.pem -exch_pass P@ssw0rd -out ra.hex\n"
+"        -exch_keyout alice_ra.pem -exch_pass P@ssw0rd -out ra.hex\n"
 "    gmssl sm2exch -stage respond \\\n"
-"          -key bob.pem -pass P@ssw0rd -id Bob \\\n"
-"          -peer_pubkey alicepub.pem -peer_id Alice -in ra.hex \\\n"
-"          -exch_keyout bob_rb.pem -exch_pass P@ssw0rd \\\n"
-"          -secret_state_out bob_secret_state.hex -out rb_sb.hex\n"
+"        -key bob.pem -pass P@ssw0rd -id Bob \\\n"
+"        -peer_pubkey alicepub.pem -peer_id Alice -in ra.hex \\\n"
+"        -exch_keyout bob_rb.pem -exch_pass P@ssw0rd \\\n"
+"        -secret_state_out bob_secret_state.hex -out rb_sb.hex\n"
 "    gmssl sm2exch -stage confirm \\\n"
-"          -key alice.pem -pass P@ssw0rd -id Alice \\\n"
-"          -peer_pubkey bobpub.pem -peer_id Bob \\\n"
-"          -exch_key alice_ra.pem -exch_pass P@ssw0rd -in rb_sb.hex \\\n"
-"          -keylen 48 -keyout alice_shared_key.hex -out sa.hex\n"
+"        -key alice.pem -pass P@ssw0rd -id Alice \\\n"
+"        -peer_pubkey bobpub.pem -peer_id Bob \\\n"
+"        -exch_key alice_ra.pem -exch_pass P@ssw0rd -in rb_sb.hex \\\n"
+"        -keylen 48 -keyout alice_shared_key.hex -out sa.hex\n"
 "    gmssl sm2exch -stage finish \\\n"
-"          -key bob.pem -pass P@ssw0rd -id Bob \\\n"
-"          -peer_pubkey alicepub.pem -peer_id Alice \\\n"
-"          -exch_key bob_rb.pem -exch_pass P@ssw0rd \\\n"
-"          -secret_state bob_secret_state.hex -in sa.hex \\\n"
-"          -keylen 48 -keyout bob_shared_key.hex\n"
+"        -key bob.pem -pass P@ssw0rd -id Bob \\\n"
+"        -peer_pubkey alicepub.pem -peer_id Alice \\\n"
+"        -exch_key bob_rb.pem -exch_pass P@ssw0rd \\\n"
+"        -secret_state bob_secret_state.hex -in sa.hex \\\n"
+"        -keylen 48 -keyout bob_shared_key.hex\n"
 "\n"
 "Certificate workflow:\n"
 "\n"
 "    gmssl sm2exch -stage respond \\\n"
-"          -key bob_enc_key.pem -pass P@ssw0rd -id Bob \\\n"
-"          -peer_cert alice_enc_cert.pem -peer_id Alice -in ra.hex \\\n"
-"          -exch_keyout bob_rb.pem -exch_pass P@ssw0rd \\\n"
-"          -secret_state_out bob_secret_state.hex -out rb_sb.hex\n"
+"        -key bob_enc_key.pem -pass P@ssw0rd -id Bob \\\n"
+"        -peer_cert alice_enc_cert.pem -peer_id Alice -in ra.hex \\\n"
+"        -exch_keyout bob_rb.pem -exch_pass P@ssw0rd \\\n"
+"        -secret_state_out bob_secret_state.hex -out rb_sb.hex\n"
 "    gmssl sm2exch -stage confirm \\\n"
-"          -key alice_enc_key.pem -pass P@ssw0rd -id Alice \\\n"
-"          -peer_cert bob_enc_cert.pem -peer_id Bob \\\n"
-"          -exch_key alice_ra.pem -exch_pass P@ssw0rd -in rb_sb.hex \\\n"
-"          -keyout alice_shared_key.hex -out sa.hex\n"
+"        -key alice_enc_key.pem -pass P@ssw0rd -id Alice \\\n"
+"        -peer_cert bob_enc_cert.pem -peer_id Bob \\\n"
+"        -exch_key alice_ra.pem -exch_pass P@ssw0rd -in rb_sb.hex \\\n"
+"        -keyout alice_shared_key.hex -out sa.hex\n"
 "\n"
 "Notes\n"
 "\n"
diff --git a/tools/sm4_cbc.c b/tools/sm4_cbc.c
index 1efe6401..bfa374df 100755
--- a/tools/sm4_cbc.c
+++ b/tools/sm4_cbc.c
@@ -18,7 +18,7 @@
 #include <gmssl/error.h>
 
 
-static const char *usage = "{-encrypt|-decrypt} -key hex -iv hex [-in file] [-out file]";
+static const char *usage = "{-encrypt|-decrypt} -key hex -iv hex [-pkcs7_padding] [-in file] [-out file]";
 
 static const char *options =
 "\n"
@@ -28,16 +28,20 @@ static const char *options =
 "    -decrypt            Decrypt\n"
 "    -key hex            Symmetric key in HEX format\n"
 "    -iv hex             IV in HEX format\n"
-"    -in file | stdin    Input data\n"
+"    -pkcs7_padding      Enable PKCS#7 padding\n"
+"                        Encrypt input can be any byte length; decrypt input must be a multiple of 16 bytes\n"
+"    -in file | stdin    Input data. Without `-pkcs7_padding`, input length must be a multiple of 16 bytes\n"
 "    -out file | stdout  Output data\n"
 "\n"
 "Examples\n"
 "\n"
-"  $ TEXT=`gmssl rand -outlen 20 -hex`\n"
-"  $ KEY=`gmssl rand -outlen 16 -hex`\n"
-"  $ IV=`gmssl rand -outlen 16 -hex`\n"
-"  $ echo -n $TEXT | gmssl sm4_cbc -encrypt -key $KEY -iv $IV -out sm4_cbc_ciphertext.bin\n"
-"  $ gmssl sm4_cbc -decrypt -key $KEY -iv $IV -in sm4_cbc_ciphertext.bin\n"
+"  KEY=`gmssl rand -outlen 16 -hex`\n"
+"  IV=`gmssl rand -outlen 16 -hex`\n"
+"  echo -n 0123456789abcdef | gmssl sm4_cbc -encrypt -key $KEY -iv $IV -out sm4_cbc_ciphertext.bin\n"
+"  gmssl sm4_cbc -decrypt -key $KEY -iv $IV -in sm4_cbc_ciphertext.bin\n"
+"\n"
+"  echo -n abc | gmssl sm4_cbc -encrypt -pkcs7_padding -key $KEY -iv $IV -out sm4_cbc_ciphertext.bin\n"
+"  gmssl sm4_cbc -decrypt -pkcs7_padding -key $KEY -iv $IV -in sm4_cbc_ciphertext.bin\n"
 "\n";
 
 int sm4_cbc_main(int argc, char **argv)
@@ -49,16 +53,25 @@ int sm4_cbc_main(int argc, char **argv)
 	char *ivhex = NULL;
 	char *infile = NULL;
 	char *outfile = NULL;
+	int pkcs7_padding = 0;
 	uint8_t key[16];
 	size_t keylen;
 	uint8_t iv[16];
 	size_t ivlen;
 	FILE *infp = stdin;
 	FILE *outfp = stdout;
+	SM4_KEY sm4_key;
 	SM4_CBC_CTX ctx;
 	uint8_t buf[4096];
+	uint8_t outbuf[4096];
+	uint8_t block[16];
+	size_t block_nbytes = 0;
 	size_t inlen;
 	size_t outlen;
+	size_t nblocks;
+	size_t len;
+	size_t left;
+	size_t inpos;
 
 	argc--;
 	argv++;
@@ -108,6 +121,8 @@ int sm4_cbc_main(int argc, char **argv)
 				fprintf(stderr, "gmssl %s: invalid IV hex digits\n", prog);
 				goto end;
 			}
+		} else if (!strcmp(*argv, "-pkcs7_padding")) {
+			pkcs7_padding = 1;
 		} else if (!strcmp(*argv, "-in")) {
 			if (--argc < 1) goto bad;
 			infile = *(++argv);
@@ -147,33 +162,74 @@ bad:
 		goto end;
 	}
 
-	if (enc) {
+	if (pkcs7_padding && enc) {
 		if (sm4_cbc_encrypt_init(&ctx, key, iv) != 1) {
 			error_print();
 			goto end;
 		}
-	} else {
+	} else if (pkcs7_padding) {
 		if (sm4_cbc_decrypt_init(&ctx, key, iv) != 1) {
 			error_print();
 			goto end;
 		}
+	} else if (enc) {
+		sm4_set_encrypt_key(&sm4_key, key);
+	} else {
+		sm4_set_decrypt_key(&sm4_key, key);
 	}
 
 	while ((inlen = fread(buf, 1, sizeof(buf), infp)) > 0) {
 
-		if (enc) {
+		if (pkcs7_padding && enc) {
 			if (sm4_cbc_encrypt_update(&ctx, buf, inlen, buf, &outlen) != 1) {
 				error_print();
 				goto end;
 			}
-		} else {
+		} else if (pkcs7_padding) {
 			if (sm4_cbc_decrypt_update(&ctx, buf, inlen, buf, &outlen) != 1) {
 				error_print();
 				goto end;
 			}
+		} else {
+			outlen = 0;
+			inpos = 0;
+
+			if (block_nbytes) {
+				left = sizeof(block) - block_nbytes;
+				if (inlen < left) {
+					memcpy(block + block_nbytes, buf, inlen);
+					block_nbytes += inlen;
+					continue;
+				}
+				memcpy(block + block_nbytes, buf, left);
+				if (enc) {
+					sm4_cbc_encrypt_blocks(&sm4_key, iv, block, 1, outbuf);
+				} else {
+					sm4_cbc_decrypt_blocks(&sm4_key, iv, block, 1, outbuf);
+				}
+				outlen = sizeof(block);
+				inpos = left;
+				block_nbytes = 0;
+			}
+
+			nblocks = (inlen - inpos) / sizeof(block);
+			len = nblocks * sizeof(block);
+			if (len) {
+				if (enc) {
+					sm4_cbc_encrypt_blocks(&sm4_key, iv, buf + inpos, nblocks, outbuf + outlen);
+				} else {
+					sm4_cbc_decrypt_blocks(&sm4_key, iv, buf + inpos, nblocks, outbuf + outlen);
+				}
+				outlen += len;
+				inpos += len;
+			}
+			if (inlen > inpos) {
+				block_nbytes = inlen - inpos;
+				memcpy(block, buf + inpos, block_nbytes);
+			}
 		}
 
-		if (fwrite(buf, 1, outlen, outfp) != outlen) {
+		if (fwrite(pkcs7_padding ? buf : outbuf, 1, outlen, outfp) != outlen) {
 			fprintf(stderr, "gmssl %s: output failure : %s\n", prog, strerror(errno));
 			goto end;
 		}
@@ -183,16 +239,22 @@ bad:
 		goto end;
 	}
 
-	if (enc) {
+	if (pkcs7_padding && enc) {
 		if (sm4_cbc_encrypt_finish(&ctx, buf, &outlen) != 1) {
 			error_print();
 			goto end;
 		}
-	} else {
+	} else if (pkcs7_padding) {
 		if (sm4_cbc_decrypt_finish(&ctx, buf, &outlen) != 1) {
 			error_print();
 			goto end;
 		}
+	} else {
+		if (block_nbytes) {
+			fprintf(stderr, "gmssl %s: input length must be multiple of 16 bytes when PKCS#7 padding is not enabled\n", prog);
+			goto end;
+		}
+		outlen = 0;
 	}
 	if (fwrite(buf, 1, outlen, outfp) != outlen) {
 		fprintf(stderr, "gmssl %s: output failure : %s\n", prog, strerror(errno));
@@ -204,7 +266,10 @@ bad:
 end:
 	gmssl_secure_clear(key, sizeof(key));
 	gmssl_secure_clear(iv, sizeof(iv));
+	gmssl_secure_clear(&sm4_key, sizeof(sm4_key));
 	gmssl_secure_clear(&ctx, sizeof(ctx));
+	gmssl_secure_clear(outbuf, sizeof(outbuf));
+	gmssl_secure_clear(block, sizeof(block));
 	gmssl_secure_clear(buf, sizeof(buf));
 	if (infile && infp) fclose(infp);
 	if (outfile && outfp) fclose(outfp);
diff --git a/tools/sm4_cbc_mac.c b/tools/sm4_cbc_mac.c
index 58a183bb..a7063926 100644
--- a/tools/sm4_cbc_mac.c
+++ b/tools/sm4_cbc_mac.c
@@ -20,11 +20,12 @@
 static const char *usage = "-key hex [-in file | -in_str str] [-bin|-hex] [-out file]";
 
 static const char *help =
+"\n"
 "Options\n"
 "\n"
 "    -key hex               Hex string of the MAC key, 16 bytes\n"
-"    -in_str str            Input as text string\n"
-"    -in file | stdin       Input file path\n"
+"    -in_str str            Input as text string, any byte length is accepted\n"
+"    -in file | stdin       Input file path, any byte length is accepted\n"
 "                           `-in_str` and `-in` should not be used together\n"
 "                           If neither `-in` nor `-in_str` specified, read from stdin\n"
 "    -hex                   Output MAC-tag as hex string (by default)\n"
@@ -34,20 +35,20 @@ static const char *help =
 "\n"
 "Examples\n"
 "\n"
-"    KEY_HEX=`gmssl rand -outlen 16 -hex`\n"
-"    gmssl sm4_cbc_mac -key $KEY_HEX -in_str abc\n"
+"  KEY=`gmssl rand -outlen 16 -hex`\n"
+"  gmssl sm4_cbc_mac -key $KEY -in_str abc\n"
 "\n"
-"    gmssl sm4_cbc_mac -key $KEY_HEX -in_str abc -bin\n"
+"  gmssl sm4_cbc_mac -key $KEY -in_str abc -bin\n"
 "\n"
-"    gmssl sm4_cbc_mac -key $KEY_HEX -in /path/to/file\n"
+"  gmssl sm4_cbc_mac -key $KEY -in /path/to/file\n"
 "\n"
 "  When reading from stdin, make sure the trailing newline character is removed\n"
 "\n"
 "  Linux/Mac:\n"
-"    echo -n abc | gmssl sm4_cbc_mac -key $KEY_HEX\n"
+"  echo -n abc | gmssl sm4_cbc_mac -key $KEY\n"
 "\n"
 "  Windows:\n"
-"    C:\\> echo |set/p=\"abc\" | gmssl sm4_cbc_mac -key 11223344556677881122334455667788\n"
+"  echo |set/p=\"abc\" | gmssl sm4_cbc_mac -key 11223344556677881122334455667788\n"
 "\n";
 
 int sm4_cbc_mac_main(int argc, char **argv)
diff --git a/tools/sm4_ccm.c b/tools/sm4_ccm.c
index a2b42a2e..515f0754 100755
--- a/tools/sm4_ccm.c
+++ b/tools/sm4_ccm.c
@@ -21,6 +21,7 @@
 static const char *usage = "{-encrypt|-decrypt} -key hex -iv hex [-aad str| -aad_hex hex] [-taglen num] [-in file] [-out file]";
 
 static const char *options =
+"\n"
 "Options\n"
 "\n"
 "    -encrypt            Encrypt\n"
@@ -30,17 +31,16 @@ static const char *options =
 "    -aad str            Authenticated-only message\n"
 "    -aad_hex hex        Authenticated-only data in HEX format\n"
 "    -taglen num         MAC tag length, 4 to 16 bytes\n"
-"    -in file | stdin    Input data\n"
+"    -in file | stdin    Input data. Encrypt input can be any byte length within CCM limits\n"
+"                        Decrypt input is ciphertext || tag and must be at least taglen bytes\n"
 "    -out file | stdout  Output data\n"
 "\n"
 "Examples\n"
 "\n"
-"  $ TEXT=`gmssl rand -outlen 20 -hex`\n"
-"  $ KEY=`gmssl rand -outlen 16 -hex`\n"
-"  $ IV=`gmssl rand -outlen 12 -hex`\n"
-"  $ AAD=\"The AAD Data\"\n"
-"  $ echo -n $TEXT | gmssl sm4_ccm -encrypt -key $KEY -iv $IV -aad $AAD -out sm4_ccm_ciphertext.bin\n"
-"  $ gmssl sm4_ccm -decrypt -key $KEY -iv $IV -aad $AAD -in sm4_ccm_ciphertext.bin\n"
+"  KEY=`gmssl rand -outlen 16 -hex`\n"
+"  IV=`gmssl rand -outlen 12 -hex`\n"
+"  echo -n abc | gmssl sm4_ccm -encrypt -key $KEY -iv $IV -aad_hex 001122 -out sm4_ccm_ciphertext.bin\n"
+"  gmssl sm4_ccm -decrypt -key $KEY -iv $IV -aad_hex 001122 -in sm4_ccm_ciphertext.bin\n"
 "\n";
 
 static uint8_t *read_content(FILE *infp, size_t *outlen, const char *prog)
diff --git a/tools/sm4_cfb.c b/tools/sm4_cfb.c
index a4cdbcc9..2553987b 100755
--- a/tools/sm4_cfb.c
+++ b/tools/sm4_cfb.c
@@ -29,22 +29,21 @@ static const char *options =
 "    -decrypt            Decrypt\n"
 "    -key hex            Symmetric key in HEX format\n"
 "    -iv hex             IV in HEX format\n"
-"    -in file | stdin    Input data\n"
+"    -in file | stdin    Input data, any byte length is accepted\n"
 "    -out file | stdout  Output data\n"
 "\n"
 "Examples\n"
 "\n"
-"  $ TEXT=`gmssl rand -outlen 20 -hex`\n"
-"  $ KEY=`gmssl rand -outlen 16 -hex`\n"
-"  $ IV=`gmssl rand -outlen 16 -hex`\n"
-"  $ echo -n $TEXT | gmssl sm4_cfb -encrypt -key $KEY -iv $IV -out sm4_cfb128_ciphertext.bin\n"
-"  $ gmssl sm4_cfb -decrypt -key $KEY -iv $IV -in sm4_cfb128_ciphertext.bin\n"
+"  KEY=`gmssl rand -outlen 16 -hex`\n"
+"  IV=`gmssl rand -outlen 16 -hex`\n"
+"  echo -n abc | gmssl sm4_cfb -encrypt -key $KEY -iv $IV -out sm4_cfb128_ciphertext.bin\n"
+"  gmssl sm4_cfb -decrypt -key $KEY -iv $IV -in sm4_cfb128_ciphertext.bin\n"
 "\n"
-"  $ echo -n $TEXT | gmssl sm4_cfb -sbytes 1 -encrypt -key $KEY -iv $IV -out sm4_cfb8_ciphertext.bin\n"
-"  $ gmssl sm4_cfb -sbytes 1 -decrypt -key $KEY -iv $IV -in sm4_cfb8_ciphertext.bin\n"
+"  echo -n abc | gmssl sm4_cfb -sbytes 1 -encrypt -key $KEY -iv $IV -out sm4_cfb8_ciphertext.bin\n"
+"  gmssl sm4_cfb -sbytes 1 -decrypt -key $KEY -iv $IV -in sm4_cfb8_ciphertext.bin\n"
 "\n"
-"  $ echo -n $TEXT | gmssl sm4_cfb -sbytes 8 -encrypt -key $KEY -iv $IV -out sm4_cfb64_ciphertext.bin\n"
-"  $ gmssl sm4_cfb -sbytes 8 -decrypt -key $KEY -iv $IV -in sm4_cfb64_ciphertext.bin\n"
+"  echo -n 01234567 | gmssl sm4_cfb -sbytes 8 -encrypt -key $KEY -iv $IV -out sm4_cfb64_ciphertext.bin\n"
+"  gmssl sm4_cfb -sbytes 8 -decrypt -key $KEY -iv $IV -in sm4_cfb64_ciphertext.bin\n"
 "\n";
 
 int sm4_cfb_main(int argc, char **argv)
diff --git a/tools/sm4_ctr.c b/tools/sm4_ctr.c
index 80157a77..e3adb6ac 100755
--- a/tools/sm4_ctr.c
+++ b/tools/sm4_ctr.c
@@ -28,16 +28,15 @@ static const char *options =
 "    -decrypt            Decrypt\n"
 "    -key hex            Symmetric key in HEX format\n"
 "    -iv hex             IV in HEX format\n"
-"    -in file | stdin    Input data\n"
+"    -in file | stdin    Input data, any byte length is accepted\n"
 "    -out file | stdout  Output data\n"
 "\n"
 "Examples\n"
 "\n"
-"  $ TEXT=`gmssl rand -outlen 20 -hex`\n"
-"  $ KEY=`gmssl rand -outlen 16 -hex`\n"
-"  $ IV=`gmssl rand -outlen 16 -hex`\n"
-"  $ echo -n $TEXT | gmssl sm4_ctr -key $KEY -iv $IV -out sm4_ctr_ciphertext.bin\n"
-"  $ gmssl sm4_ctr -key $KEY -iv $IV -in sm4_ctr_ciphertext.bin\n"
+"  KEY=`gmssl rand -outlen 16 -hex`\n"
+"  IV=`gmssl rand -outlen 16 -hex`\n"
+"  echo -n abc | gmssl sm4_ctr -encrypt -key $KEY -iv $IV -out sm4_ctr_ciphertext.bin\n"
+"  gmssl sm4_ctr -decrypt -key $KEY -iv $IV -in sm4_ctr_ciphertext.bin\n"
 "\n";
 
 int sm4_ctr_main(int argc, char **argv)
diff --git a/tools/sm4_ecb.c b/tools/sm4_ecb.c
index b3e25696..26186f99 100755
--- a/tools/sm4_ecb.c
+++ b/tools/sm4_ecb.c
@@ -27,15 +27,14 @@ static const char *options =
 "    -encrypt            Encrypt\n"
 "    -decrypt            Decrypt\n"
 "    -key hex            Symmetric key in HEX format\n"
-"    -in file | stdin    Input data\n"
+"    -in file | stdin    Input data, length must be a multiple of 16 bytes\n"
 "    -out file | stdout  Output data\n"
 "\n"
 "Examples\n"
 "\n"
-"  $ TEXT=`gmssl rand -outlen 32 -hex`\n"
-"  $ KEY=`gmssl rand -outlen 16 -hex`\n"
-"  $ echo -n $TEXT | gmssl sm4_ecb -encrypt -key $KEY -out sm4_ecb_ciphertext.bin\n"
-"  $ gmssl sm4_ecb -decrypt -key $KEY -in sm4_ecb_ciphertext.bin\n"
+"  KEY=`gmssl rand -outlen 16 -hex`\n"
+"  echo -n 0123456789abcdef | gmssl sm4_ecb -encrypt -key $KEY -out sm4_ecb_ciphertext.bin\n"
+"  gmssl sm4_ecb -decrypt -key $KEY -in sm4_ecb_ciphertext.bin\n"
 "\n";
 
 int sm4_ecb_main(int argc, char **argv)
diff --git a/tools/sm4_ff1.c b/tools/sm4_ff1.c
index aab14c5a..183f883f 100644
--- a/tools/sm4_ff1.c
+++ b/tools/sm4_ff1.c
@@ -34,9 +34,15 @@ static const char *options =
 "    -decrypt            Decrypt\n"
 "    -key hex            SM4 key in HEX format\n"
 "    -tweak hex          FF1 tweak in HEX format\n"
-"    -digits digits      Input digits, default from stdin\n"
-"    -idcard             Input is a Chinese resident identity card number\n"
-"    -bankcard           Input is a bank card number with Luhn check digit\n"
+"    -digits digits      Input digits, default from stdin. Length must be 8 to 18 digits\n"
+"    -idcard             Input is a Chinese resident identity card number, 18 characters\n"
+"    -bankcard           Input is a bank card number with Luhn check digit, 9 to 19 digits\n"
+"\n"
+"Examples\n"
+"\n"
+"  KEY=`gmssl rand -outlen 16 -hex`\n"
+"  CIPHERTEXT=`gmssl sm4_ff1 -encrypt -key $KEY -digits 0123456789012345`\n"
+"  gmssl sm4_ff1 -decrypt -key $KEY -digits $CIPHERTEXT\n"
 "\n";
 
 static uint8_t *read_content(FILE *infp, size_t *outlen, const char *prog)
diff --git a/tools/sm4_gcm.c b/tools/sm4_gcm.c
index 33f359af..143c9364 100755
--- a/tools/sm4_gcm.c
+++ b/tools/sm4_gcm.c
@@ -21,6 +21,7 @@
 static const char *usage = "{-encrypt|-decrypt} -key hex -iv hex [-aad str| -aad_hex hex] [-taglen num] [-in file] [-out file]";
 
 static const char *options =
+"\n"
 "Options\n"
 "\n"
 "    -encrypt            Encrypt\n"
@@ -30,17 +31,16 @@ static const char *options =
 "    -aad str            Authenticated-only message\n"
 "    -aad_hex hex        Authenticated-only data in HEX format\n"
 "    -taglen num         MAC tag length, default 16 bytes\n"
-"    -in file | stdin    Input data\n"
+"    -in file | stdin    Input data. Encrypt input can be any byte length\n"
+"                        Decrypt input is ciphertext || tag and must be at least taglen bytes\n"
 "    -out file | stdout  Output data\n"
 "\n"
 "Examples\n"
 "\n"
-"  $ TEXT=`gmssl rand -outlen 20 -hex`\n"
-"  $ KEY=`gmssl rand -outlen 16 -hex`\n"
-"  $ IV=`gmssl rand -outlen 12 -hex`\n"
-"  $ AAD=\"The AAD Data\"\n"
-"  $ echo -n $TEXT | gmssl sm4_gcm -encrypt -key $KEY -iv $IV -aad $AAD -out sm4_gcm_ciphertext.bin\n"
-"  $ gmssl sm4_gcm -decrypt -key $KEY -iv $IV -aad $AAD -in sm4_gcm_ciphertext.bin\n"
+"  KEY=`gmssl rand -outlen 16 -hex`\n"
+"  IV=`gmssl rand -outlen 12 -hex`\n"
+"  echo -n abc | gmssl sm4_gcm -encrypt -key $KEY -iv $IV -aad_hex 001122 -out sm4_gcm_ciphertext.bin\n"
+"  gmssl sm4_gcm -decrypt -key $KEY -iv $IV -aad_hex 001122 -in sm4_gcm_ciphertext.bin\n"
 "\n";
 
 int sm4_gcm_main(int argc, char **argv)
diff --git a/tools/sm4_ofb.c b/tools/sm4_ofb.c
index 0d920134..c84e9dcf 100755
--- a/tools/sm4_ofb.c
+++ b/tools/sm4_ofb.c
@@ -28,16 +28,15 @@ static const char *options =
 "    -decrypt            Decrypt\n"
 "    -key hex            Symmetric key in HEX format\n"
 "    -iv hex             IV in HEX format\n"
-"    -in file | stdin    Input data\n"
+"    -in file | stdin    Input data, any byte length is accepted\n"
 "    -out file | stdout  Output data\n"
 "\n"
 "Examples\n"
 "\n"
-"  $ TEXT=`gmssl rand -outlen 32 -hex`\n"
-"  $ KEY=`gmssl rand -outlen 16 -hex`\n"
-"  $ IV=`gmssl rand -outlen 16 -hex`\n"
-"  $ echo -n $TEXT | gmssl sm4_ofb -encrypt -key $KEY -iv $IV -out sm4_ofb_ciphertext.bin\n"
-"  $ gmssl sm4_ofb -decrypt -key $KEY -iv $IV -in sm4_ofb_ciphertext.bin\n"
+"  KEY=`gmssl rand -outlen 16 -hex`\n"
+"  IV=`gmssl rand -outlen 16 -hex`\n"
+"  echo -n abc | gmssl sm4_ofb -encrypt -key $KEY -iv $IV -out sm4_ofb_ciphertext.bin\n"
+"  gmssl sm4_ofb -decrypt -key $KEY -iv $IV -in sm4_ofb_ciphertext.bin\n"
 "\n";
 
 int sm4_ofb_main(int argc, char **argv)
diff --git a/tools/sm4_xts.c b/tools/sm4_xts.c
index 94bedc8e..565afd93 100755
--- a/tools/sm4_xts.c
+++ b/tools/sm4_xts.c
@@ -21,6 +21,7 @@
 static const char *usage = "{-encrypt|-decrypt} -key hex -iv hex -data_unit_size num [-in file] [-out file]";
 
 static const char *options =
+"\n"
 "Options\n"
 "\n"
 "    -encrypt              Encrypt\n"
@@ -28,16 +29,17 @@ static const char *options =
 "    -key hex              Symmetric key in HEX format, 32 bytes\n"
 "    -iv hex               IV (tweak in XTS), 16 bytes\n"
 "    -data_unit_size num   Encrypted disk sector size, typically 512 or 4096 bytes\n"
-"    -in file | stdin      Input data\n"
+"                          Input and output lengths must be multiples of this size\n"
+"    -in file | stdin      Input data, length must be a multiple of data_unit_size\n"
 "    -out file | stdout    Output data\n"
 "\n"
 "Examples\n"
 "\n"
-"  $ DATA=`gmssl rand -outlen 2048`\n"
-"  $ KEY=`gmssl rand -outlen 32 -hex`\n"
-"  $ IV=`gmssl rand -outlen 16 -hex`\n"
-"  $ echo -n $DATA | gmssl sm4_xts -encrypt -key $KEY -iv $IV -data_unit_size 512 -out sm4_xts_ciphertext.bin\n"
-"  $ gmssl sm4_xts -decrypt -key $KEY -iv $IV -data_unit_size 512 -in sm4_xts_ciphertext.bin\n"
+"  KEY=`gmssl rand -outlen 32 -hex`\n"
+"  IV=`gmssl rand -outlen 16 -hex`\n"
+"  gmssl rand -outlen 512 -out sm4_xts_plaintext.bin\n"
+"  gmssl sm4_xts -encrypt -key $KEY -iv $IV -data_unit_size 512 -in sm4_xts_plaintext.bin -out sm4_xts_ciphertext.bin\n"
+"  gmssl sm4_xts -decrypt -key $KEY -iv $IV -data_unit_size 512 -in sm4_xts_ciphertext.bin -out sm4_xts_decrypted.bin\n"
 "\n";
 
 int sm4_xts_main(int argc, char **argv)
diff --git a/tools/sm9exch.c b/tools/sm9exch.c
index ae822e8b..11b07057 100644
--- a/tools/sm9exch.c
+++ b/tools/sm9exch.c
@@ -69,26 +69,26 @@ static const char *options =
 "Examples\n"
 "\n"
 "    gmssl sm9setup -alg sm9encrypt -pass P@ssw0rd \\\n"
-"          -out sm9_msk.pem -pubout sm9_mpk.pem\n"
+"        -out sm9_msk.pem -pubout sm9_mpk.pem\n"
 "    gmssl sm9keygen -alg sm9keyagreement -in sm9_msk.pem -inpass P@ssw0rd \\\n"
-"          -id Alice -out alice.pem -outpass 123456\n"
+"        -id Alice -out alice.pem -outpass 123456\n"
 "    gmssl sm9keygen -alg sm9keyagreement -in sm9_msk.pem -inpass P@ssw0rd \\\n"
-"          -id Bob -out bob.pem -outpass 123456\n"
+"        -id Bob -out bob.pem -outpass 123456\n"
 "    gmssl sm9exch -stage init \\\n"
-"          -pubmaster sm9_mpk.pem -peer_id Bob \\\n"
-"          -exch_keyout alice_ra.pem -out ra.hex\n"
+"        -pubmaster sm9_mpk.pem -peer_id Bob \\\n"
+"        -exch_keyout alice_ra.pem -out ra.hex\n"
 "    gmssl sm9exch -stage respond \\\n"
-"          -pubmaster sm9_mpk.pem -key bob.pem -pass 123456 -id Bob \\\n"
-"          -peer_id Alice -in ra.hex \\\n"
-"          -exch_keyout bob_rb.pem -out rb_sb.hex\n"
+"        -pubmaster sm9_mpk.pem -key bob.pem -pass 123456 -id Bob \\\n"
+"        -peer_id Alice -in ra.hex \\\n"
+"        -exch_keyout bob_rb.pem -out rb_sb.hex\n"
 "    gmssl sm9exch -stage confirm \\\n"
-"          -pubmaster sm9_mpk.pem -key alice.pem -pass 123456 -id Alice \\\n"
-"          -peer_id Bob -exch_key alice_ra.pem -in rb_sb.hex \\\n"
-"          -keylen 48 -keyout alice_shared_key.hex -out sa.hex\n"
+"        -pubmaster sm9_mpk.pem -key alice.pem -pass 123456 -id Alice \\\n"
+"        -peer_id Bob -exch_key alice_ra.pem -in rb_sb.hex \\\n"
+"        -keylen 48 -keyout alice_shared_key.hex -out sa.hex\n"
 "    gmssl sm9exch -stage finish \\\n"
-"          -pubmaster sm9_mpk.pem -key bob.pem -pass 123456 -id Bob \\\n"
-"          -peer_id Alice -exch_key bob_rb.pem \\\n"
-"          -in sa.hex -keylen 48 -keyout bob_shared_key.hex\n"
+"        -pubmaster sm9_mpk.pem -key bob.pem -pass 123456 -id Bob \\\n"
+"        -peer_id Alice -exch_key bob_rb.pem \\\n"
+"        -in sa.hex -keylen 48 -keyout bob_shared_key.hex\n"
 "\n"
 "Notes\n"
 "\n"
diff --git a/tools/tls12_client.c b/tools/tls12_client.c
index 03c646f7..5ff819df 100644
--- a/tools/tls12_client.c
+++ b/tools/tls12_client.c
@@ -38,8 +38,7 @@ static const char *help =
 "    -server_name str       Send server_name (SNI) request\n"
 "    -trusted_ca_keys       Send trusted_ca_keys request\n"
 "    -renegotiation_info    Send renegotiation_info extension\n"
-"    -renegotiation_info_scsv\n"
-"                          Send TLS_EMPTY_RENEGOTIATION_INFO_SCSV\n"
+"    -renegotiation_info_scsv  Send TLS_EMPTY_RENEGOTIATION_INFO_SCSV\n"
 "    -status_request        Send status_request (OCSP Stapling) request\n"
 "    -get path              Send a HTTP GET request and read response until close or timeout\n"
 "    -in file | stdin       Send input data and read response until close or timeout\n"
diff --git a/tools/tls13_client.c b/tools/tls13_client.c
index 13b10ed5..dccef863 100644
--- a/tools/tls13_client.c
+++ b/tools/tls13_client.c
@@ -188,7 +188,7 @@ static const char *help =
 "    -key pem                  Client's encrypted private key in PEM format\n"
 "    -pass str                 Password to decrypt private key, prompt if not given\n"
 "    -server_name str          Send server_name (SNI) request\n"
-"    -signature_algorithms_cert Send signature_algorithms_cert extension\n"
+"    -signature_algorithms_cert  Send signature_algorithms_cert extension\n"
 "    -certificate_authorities  Send certificate_authorities extension\n"
 "    -status_request           Send status_request (OCSP Stapling) request\n"
 "    -ct                       Send signed_certificate_timestamp (SCT) request\n"
@@ -203,7 +203,7 @@ static const char *help =
 "    -key_update_seq_num num   Send KeyUpdate handshake after sending/receiving <num> records\n"
 "    -post_handshake_auth      Support post_handshake_auth\n"
 "    -client_cert_optional     Allow client send empty Certificate\n"
-"    -tls13_change_cipher_spec Support ChangeCipherSpec in TLS 1.3 to be compatible with middlebox\n"
+"    -tls13_change_cipher_spec  Support ChangeCipherSpec in TLS 1.3 to be compatible with middlebox\n"
 "    -get path                 Send a HTTP GET request and read response until close or timeout\n"
 "    -in file | stdin          Send input data and read response until close or timeout\n"
 "    -verbose                  Print TLS handshake messages\n"
diff --git a/tools/tls13_server.c b/tools/tls13_server.c
index 1fe8f532..814142d6 100644
--- a/tools/tls13_server.c
+++ b/tools/tls13_server.c
@@ -46,7 +46,7 @@ static const char *help =
 "    -new_session_ticket num   Send NewSessionTicket <num> times\n"
 "    -ticket_key hex           Session ticket encrypt/decrypt key in HEX format\n"
 "    -key_update_seq_num num   Send KeyUpdate handshake after sending/receiving <num> records\n"
-"    -tls13_change_cipher_spec Support ChangeCipherSpec in TLS 1.3 to be compatible with middlebox\n"
+"    -tls13_change_cipher_spec  Support ChangeCipherSpec in TLS 1.3 to be compatible with middlebox\n"
 "    -verbose                  Print TLS handshake messages\n"
 "\n"
 #include "tls13_help.h"
diff --git a/tools/zuc_128_eea3.c b/tools/zuc_128_eea3.c
index 26c4b7b3..a8f6eed4 100644
--- a/tools/zuc_128_eea3.c
+++ b/tools/zuc_128_eea3.c
@@ -21,7 +21,7 @@
 
 
 static const char *usage =
-	"-key hex -count num -bearer num -direction num [-in file|-in_hex hex] [-out file]";
+	"-key hex -count num -bearer num -direction num [-in file] [-out file]";
 
 static const char *help =
 "Options\n"
@@ -30,17 +30,14 @@ static const char *help =
 "    -count num           COUNT parameter, 32-bit integer, decimal or 0x-prefixed hex\n"
 "    -bearer num          BEARER parameter, 5-bit integer in [0, 31]\n"
 "    -direction num       DIRECTION parameter, 0 or 1\n"
-"    -in_hex hex          Input bytes in HEX format\n"
-"    -in file | stdin     Input file path\n"
-"                         `-in_hex` and `-in` should not be used together\n"
-"                         If neither `-in_hex` nor `-in` specified, read from stdin\n"
+"    -in file | stdin     Input file path. If not specified, read from stdin\n"
 "    -out file | stdout   Output ciphertext bytes. If not specified, output to stdout\n"
 "\n"
 "Examples\n"
 "\n"
 "    gmssl zuc_128_eea3 -key 173d14ba5003731d7a60049470f00a29 \\\n"
 "        -count 0x66035492 -bearer 15 -direction 0 \\\n"
-"        -in_hex 6cf65340735552ab0c9752fa6f9025fe0bd675d9005875b2 -out ciphertext.bin\n"
+"        -in plaintext.bin -out ciphertext.bin\n"
 "\n";
 
 static int parse_uint64(const char *s, uint64_t max, uint64_t *out)
@@ -117,7 +114,6 @@ int zuc_128_eea3_main(int argc, char **argv)
 	int ret = 1;
 	char *prog = argv[0];
 	char *keyhex = NULL;
-	char *inhex = NULL;
 	char *infile = NULL;
 	char *outfile = NULL;
 	uint8_t key[ZUC_KEY_SIZE];
@@ -191,18 +187,7 @@ int zuc_128_eea3_main(int argc, char **argv)
 			}
 			direction = (ZUC_BIT)v;
 			direction_set = 1;
-		} else if (!strcmp(*argv, "-in_hex")) {
-			if (infile) {
-				fprintf(stderr, "gmssl %s: `-in` and `-in_hex` should not be used together\n", prog);
-				goto end;
-			}
-			if (--argc < 1) goto bad;
-			inhex = *(++argv);
 		} else if (!strcmp(*argv, "-in")) {
-			if (inhex) {
-				fprintf(stderr, "gmssl %s: `-in` and `-in_hex` should not be used together\n", prog);
-				goto end;
-			}
 			if (--argc < 1) goto bad;
 			infile = *(++argv);
 			if (!(infp = fopen(infile, "rb"))) {
@@ -237,21 +222,7 @@ bad:
 		goto end;
 	}
 
-	if (inhex) {
-		if (strlen(inhex) % 2) {
-			fprintf(stderr, "gmssl %s: invalid input hex length\n", prog);
-			goto end;
-		}
-		nbytes = strlen(inhex) / 2;
-		if (!(in = (uint8_t *)malloc(nbytes ? nbytes : 1))) {
-			fprintf(stderr, "gmssl %s: malloc failure\n", prog);
-			goto end;
-		}
-		if (hex_to_bytes(inhex, strlen(inhex), in, &inlen) != 1) {
-			fprintf(stderr, "gmssl %s: invalid input hex digits\n", prog);
-			goto end;
-		}
-	} else if (!(in = read_content(infp, &inlen, prog))) {
+	if (!(in = read_content(infp, &inlen, prog))) {
 		goto end;
 	}
 	nbytes = inlen;
diff --git a/tools/zuc_128_eia3.c b/tools/zuc_128_eia3.c
index e54b9a77..048378e2 100644
--- a/tools/zuc_128_eia3.c
+++ b/tools/zuc_128_eia3.c
@@ -21,7 +21,7 @@
 
 
 static const char *usage =
-	"-key hex -count num -bearer num -direction num [-in file|-in_hex hex] [-hex|-bin] [-out file]";
+	"-key hex -count num -bearer num -direction num [-in file] [-hex|-bin] [-out file]";
 
 static const char *help =
 "Options\n"
@@ -30,10 +30,7 @@ static const char *help =
 "    -count num           COUNT parameter, 32-bit integer, decimal or 0x-prefixed hex\n"
 "    -bearer num          BEARER parameter, 5-bit integer in [0, 31]\n"
 "    -direction num       DIRECTION parameter, 0 or 1\n"
-"    -in_hex hex          Input message bytes in HEX format\n"
-"    -in file | stdin     Input file path\n"
-"                         `-in_hex` and `-in` should not be used together\n"
-"                         If neither `-in_hex` nor `-in` specified, read from stdin\n"
+"    -in file | stdin     Input file path. If not specified, read from stdin\n"
 "    -hex                 Output MAC as hex string (by default)\n"
 "    -bin                 Output MAC as binary\n"
 "                         `-hex` and `-bin` should not be used together\n"
@@ -42,7 +39,7 @@ static const char *help =
 "Examples\n"
 "\n"
 "    gmssl zuc_128_eia3 -key 00000000000000000000000000000000 \\\n"
-"        -count 0 -bearer 0 -direction 0 -in_hex 00\n"
+"        -count 0 -bearer 0 -direction 0 -in message.bin\n"
 "\n";
 
 static int parse_uint64(const char *s, uint64_t max, uint64_t *out)
@@ -119,7 +116,6 @@ int zuc_128_eia3_main(int argc, char **argv)
 	int ret = 1;
 	char *prog = argv[0];
 	char *keyhex = NULL;
-	char *inhex = NULL;
 	char *infile = NULL;
 	char *outfile = NULL;
 	int outformat = 0;
@@ -128,7 +124,6 @@ int zuc_128_eia3_main(int argc, char **argv)
 	uint8_t *in = NULL;
 	size_t inlen = 0;
 	size_t nbits;
-	size_t nbytes = 0;
 	uint64_t v;
 	ZUC_UINT32 count = 0;
 	ZUC_UINT5 bearer = 0;
@@ -191,18 +186,7 @@ int zuc_128_eia3_main(int argc, char **argv)
 			}
 			direction = (ZUC_BIT)v;
 			direction_set = 1;
-		} else if (!strcmp(*argv, "-in_hex")) {
-			if (infile) {
-				fprintf(stderr, "gmssl %s: `-in` and `-in_hex` should not be used together\n", prog);
-				goto end;
-			}
-			if (--argc < 1) goto bad;
-			inhex = *(++argv);
 		} else if (!strcmp(*argv, "-in")) {
-			if (inhex) {
-				fprintf(stderr, "gmssl %s: `-in` and `-in_hex` should not be used together\n", prog);
-				goto end;
-			}
 			if (--argc < 1) goto bad;
 			infile = *(++argv);
 			if (!(infp = fopen(infile, "rb"))) {
@@ -249,24 +233,9 @@ bad:
 		goto end;
 	}
 
-	if (inhex) {
-		if (strlen(inhex) % 2) {
-			fprintf(stderr, "gmssl %s: invalid input hex length\n", prog);
-			goto end;
-		}
-		nbytes = strlen(inhex) / 2;
-		if (!(in = (uint8_t *)malloc(nbytes ? nbytes : 1))) {
-			fprintf(stderr, "gmssl %s: malloc failure\n", prog);
-			goto end;
-		}
-		if (hex_to_bytes(inhex, strlen(inhex), in, &inlen) != 1) {
-			fprintf(stderr, "gmssl %s: invalid input hex digits\n", prog);
-			goto end;
-		}
-	} else if (!(in = read_content(infp, &inlen, prog))) {
+	if (!(in = read_content(infp, &inlen, prog))) {
 		goto end;
 	}
-	nbytes = inlen;
 	nbits = inlen * 8;
 
 	macword = zuc_eia_generate_mac((ZUC_UINT32 *)in, nbits, key, count, bearer, direction);