The issue was that w9 is a 32-bit register and I was using a 64 bit device. By calling this.context.x9 for the 64 bit register the Frida script worked perfectly. Many thanks to @whoopdedoo, their suggestion to log this.context was what led me to search more about ARM registers and realise my mistake.
PC = current Instruction pointer + instruction length
PC = IP + 4
PC = 0x176E4 + 4 == 176E8
destination = 0x1768C
offset is encoded as a signed number of ((destination - PC)>>1)
:\>python -c "print(hex((0x1768c-0x176e8)>>1))
unconditional jump B can be encoded from E0 00 to E7 FF
==> E + (0x0 to 0x7ff ) == 0b1110 + (...
This is an unconditional branch (thumb)
It is encoded as 11100|signed 11-bit immediate offset
E 7 D 2
1110 0111 1101 0010
so your 11-bit offset is 0b11111010010. This is sign extended to -46
The operation is:
PC = PC + (SignExtend(signed_immed_11) << 1)
where the first PC contains the address of the branch plus 4.
0x176E4 + 4 + (-46 * 2) ==...