J5 looks like a UART connector and the JT_ pins are likely JTAG. UART should give you console access to manufacturing/diagnostic commands, and JTAG should allow you to the debug the code (firmware) running on the controller CPU.
As for J3, at a guess, ROM/FW allows you to switch from the firmware stored in the flash to the built-in CPU boot ROM (e.g. in ...
I think that what you are looking for is a disassembler for PE format files (Windows Portable Executable format). The call stack itself has nothing to do with it - you need to modify the flow of a program.
Windbg and X64dbg are great debugging tools for PC, as well as IDA and Ghidra for static analysis and patching.
Almost static address can be achieved when the developer use global or static variables.
While this was somewhat popular in the old days, today it is very rare and also considered a bad practice. Furthermore, features like ASLR are used to prevent an observer to exploit known static variables by relocating the image at a random address (details omitted as ...
I found the solution when reading these two articles:
https://pentest-tools.com/blog/bluekeep-exploit-metasploit/ (Extracting the NPP Address)
https://medium.com/@alexandrevvo/testing-bluekeep-cve-2019-0708-metasploit-module-on-windows-7-ef3f28217b7b (Finding the NPP)