Arm or Thumb instructions in il2cpp file

[DhruvjVerma]

I am new to modding and would like to know if there is any way to identify whether the instructions in il2cpp (libil2cpp.so) file is written in ARM or Thumb. Also if there is any other instruction set that is used in android games then i would like to know how to identify them.

Also if the game has armeabi-v7a and arm64-v8a. Then do i need to mod both the files or any one of them (eg v7a) and delete the other one (eg v8a)

 

[Sbenny]

You can safely delete armv64-v8a when there's the armeabi-v7a folder, as it's widely supported and it runs on 99% of devices without issues. To answer your first question, in order to find out if it's THUMB or ARM, I use a simple trick which involves the use of IDA. Basically, you open the lib file in IDA and open a function you want to modify and, if the distance between an instruction and another is 2 bits (1 byte), it's THUMB, otherwise it's ARM, because ARM instructions ALWAYS occupy 4 bits (2 bytes).

Let's make an example:

.................................
124AB10 MOVS R0, #1
124AB12 ADDS R0, R1
124AB16 B sub_124AB3A
124AB18 BX LR
.................................

As you can see, the difference between 123AB10 and 124AB12 (or 124AB16 and 124AB18) is 2 bits, not 4, which means this lib is written in THUMB, while, a similar function like this:

.................................
124AB10 MOV R0, #1
124AB14 ADD R0, R1
124AB18 B sub_124AB3A
124AB1C BX LR
.................................

is written in ARM, as the distance between each line is always 4 bits (2 bytes).

 

[DhruvjVerma]

Thank You. Now i am clear

so if i have a hex function like this
9E 5B F6 02 5C 26 E8 02 10 4C 2D E9 08 B0 8D E2
how do i see if this is arm or thumb ??

 

[PixelYT]

Use armconverter.com it will help you.

 

[Sbenny]

Thank You. Now i am clear

so if i have a hex function like this
9E 5B F6 02 5C 26 E8 02 10 4C 2D E9 08 B0 8D E2
how do i see if this is arm or thumb ??

As I said above, you need to use IDA because you need to see the ASM instructions. A line of hex values isn't enough, because it can often be converted to both ARM and THUMB, so you end up being even more confused than you already are.