It’s an interesting workaround, but still a hack. For instance, it’s not possible to dynamically generate a callback address from the address that’s currently loaded in the frame. Still, if you want ...