When hooking 64-bit functions with a 5-byte JMP (E9 xx xx xx xx):
Formula for the 32-bit signed relative displacement:
int32_t displacement = (int32_t)((uintptr_t)pDestination - ((uintptr_t)pSource + 5));If the trampoline distance exceeds 2GB (|pDestination - pSource| > 0x7FFFFFFF):
Use an indirect 64-bit jump without registers:
FF 25 00 00 00 00 [8-byte absolute address]This reads the 64-bit address from RIP + 0 and jumps directly without clobbering RAX/RCX/RDX!