i'm writing optimized windows based shellcode in c++ , have problem avoiding hardcoded addresses in c++ while passing function. e.g: my_createthread(null, null, (lpthread_start_routine)&thread_callback, null, null, null); dword winapi thread_callback(lpvoid lpparam) { // stuff.. } in disassembly, shows createthread(..., cardcoded_address, ..); instead, want pass address "from location thread_callback" is there way avoid it? (because shellcode should address independent?) regards. anyways, searching/doing stuff , final thing i've done can solve delta offset. explanation: @ first function of code, there should function this: dword delta; __asm { call getbasepointer getbasepointer: pop eax sub eax, getbasepointer mov [delta], eax } you can google delta offset more details. afterwards, can this: my_createthread(null, null, (lpthread_start_routine)((dword)thread_callback + (dword)delta), null, null, null); dword