Another idea might be to pass the BRANCH_TABLE/APP_START address in an unused interrupt vector (one of the reserved vectors or an unused peripheral vector are good candidates). This would allow you to determine the LIB callback addresses from APP at runtime rather than compile time. First you look up the BRANCH_TABLE address from the interrupt vector offset address and from this you can build function pointers to LIB routines.