I think they're suggesting programming in implicit CPS/callback style. Eg: int bar(int i) { return i+1; } /* bar takes a implicit return address in [esp+0]

I think they're suggesting programming in implicit CPS/callback style. Eg: int bar(int i) { return i+1; } /* bar takes a implicit return address in [esp+0] */ noreturn foo((*ra)(int),int x) { /* where (*)(RetType) is a return address */ int y = bar(x); /* x86 call pushes eip */ ra return bar(y); /* pseudo-tail-call (push ra) */ } int quux(int x) { (*ret)(int); ret = (return); /* get implicit RA */ foo(ret,x); } // unreachable You'd also need to adjust the stack and/or frame pointer though, which is probably going to be the hard part.