Why 64-bit hooks fail when target functions are > 2GB away in virtual address space:

1. 5-Byte JMP (E9 [disp32]):
   $$\text{disp32} = \text{TargetAddress} - (\text{HookAddress} + 5)$$
   Limited to $\pm 2\text{GB}$ range from instruction pointer.
2. 14-Byte Absolute Indirect JMP:

   FF 25 00 00 00 00       ; jmp qword ptr [rip + 0]
   AA BB CC DD EE FF 00 11 ; 64-bit Target Absolute Pointer

Reaches any 64-bit address anywhere in virtual RAM without register clobbering!

Using a 14-byte indirect jump eliminates the need to allocate trampolines within 2GB of the target module. Great explanation.

Clean assembly encoding breakdown.