DUMP Garena Delta Force Mobile V1.203.37100.52

https://t.me/villagehook

// SFG 3 v1.4.5 UE4.27.2
GEngine: 0xC4A2AE8
GWorld: 0xC4A69D8
GUObjectArray: 0xC32E718
FNamePool: 0xC2EA440
GNativeAndroidApp: 0xC193EC0
CanvasMap: 0xC476DE8
LineOfSightTo: 0x9DB501C
ProcessEvent:
- AActor: 0x9B1F860
- UObject: 0x7ED3A00
@gpxmods

SIMPLE Unity Il2Cpp Api Wrapper
(Header Only)
Depends on KittyMemory

Example:

```
#include "MiniIl2Cpp.hpp"

int main_example()
{
    // LoadClass("Namespace.Class")
    LoadClass clsPlayerController = LoadClass("PlayerScript.PlayerController");
    // GetMethodPtr("Method", parametersCount);
    void *updateMethod = clsPlayerController.GetMethodPtr("Update", 0);

    HOOK(updateMethod, hook_Update, orig_Update);

    return 0;
}
```

ADR/ADRP and ADD/SUB decode function
(aarch64)

uintptr\_t DecryptInsn\_ADRP\_ADD(uintptr\_t ins\_addr, uint32\_t add\_off = 4) { uintptr\_t page\_off = ((uintptr\_t)ins\_addr & ~(uintptr\_t)(4096 \- 1)); int64\_t adrp\_pc\_rel = 0, add\_pc\_rel = 0; uint32\_t adrp\_insn = 0, add\_insn = 0; driver\->read((ins\_addr), &adrp\_insn, sizeof(uint32\_t)); driver\->read((void*)(ins\_addr + add\_off), &add\_insn, sizeof(uint32\_t)); if (!adrp\_insn || !add\_insn) { printf("failed to read insn addr\n"); return 0; } // decode adrp/adrl if ( (adrp\_insn & 0x9F000000) == 0x10000000 || (adrp\_insn & 0x9F000000) == 0x90000000 ) { int64\_t imm\_val = ((int32\_t)((adrp\_insn >> 5) & ((1 << 19) \- 1))) << 2; // immhi imm\_val |= (int32\_t)((adrp\_insn >> 29) & ((1 << 2) \- 1)); // immlo if ((adrp\_insn & 0x9F000000) == 0x90000000) { uint64\_t msbt = (imm\_val >> 20) & 1; imm\_val <<= 12; adrp\_pc\_rel = ((((uint64\_t)(1) << 32) \- msbt) << 33) | imm\_val; } else { if (imm\_val & (1 << (21 \- 1))) imm\_val |= ~((1LL << 21) \- 1); adrp\_pc\_rel = imm\_val; } } if (!adrp\_pc\_rel) { printf("failed to decode adrp/adrl imm\n"); return 0; } // decode add/sub int32\_t addimm12 = (int32\_t)((add\_insn >> 10) & ((1 << 12) \- 1)); auto shift = ((1 << 22) & add\_insn) >> 22; if (shift) addimm12 <<= 12; add\_pc\_rel = addimm12; if (!add\_pc\_rel) { printf("failed to decode add uimm\n"); return 0; } return page\_off + adrp\_pc\_rel + add\_pc\_rel; }

ADR/ADRP and LDR/STR decode function
(aarch64)

```
uintptr_t DecryptInsn_ADRP_LDR(uintptr_t ins_addr, uint32_t ldr_off = 4)
{
    uintptr_t page_off = ((uintptr_t)ins_addr & ~(uintptr_t)(4096 - 1));
    int64_t adrp_pc_rel = 0, ldr_pc_rel = 0;
    uint32_t adrp_insn = 0, ldr_insn = 0;
    driver->read(ins_addr, &adrp_insn, sizeof(uint32_t));
    driver->read(ins_addr + ldr_off, &ldr_insn, sizeof(uint32_t));
    if (!adrp_insn || !adrp_insn) {
        printf("failed to read insn addr\n");
        return 0;
    }
    // decode adrp/adrl
    if ( (adrp_insn & 0x9F000000) == 0x10000000
       || (adrp_insn & 0x9F000000) == 0x90000000
    ) {
        int64_t imm_val = ((int32_t)((adrp_insn >> 5) & ((1 << 19) - 1))) << 2; // immhi
        imm_val |= (int32_t)((adrp_insn >> 29) & ((1 << 2) - 1));             // immlo
        if ((adrp_insn & 0x9F000000) == 0x90000000) {
            uint64_t msbt = (imm_val >> 20) & 1;
            imm_val <<= 12;
            adrp_pc_rel = ((((uint64_t)(1) << 32) - msbt) << 33) | imm_val;
        } else {
            if (imm_val & (1 << (21 - 1)))
                imm_val |= ~((1LL << 21) - 1);
            adrp_pc_rel = imm_val;
        }
    }
    if (!adrp_pc_rel) {
        printf("failed to decode adrp/adrl imm\n");
        return 0;
    }
    // decode ldr/str
    if ((ldr_insn & 0x3B000000) == 0x39000000) {
        ldr_pc_rel = (int32_t)((ldr_insn >> 10) & ((1 << 12) - 1));
        ldr_pc_rel <<= (int32_t)(((ldr_insn >> 30) & ((1 << 2) - 1)));
    }
    if (!ldr_pc_rel) {
        printf("failed to decode ldr/str uimm\n");
        return 0;
    }
    return page_off + adrp_pc_rel + ldr_pc_rel;
}

```
References:
- AArch64-Decoding
- GDB
- CAPSTONE- QEMU
- getting address by reading adrp and add instruction values
- adrp and adrl instructions in arm assembly