range of BL instruction in arm state is + or - 32MB as per instruction set.how...........?
The ARM BL instruction has a 24-bit immediate for encoding the branch offset (see section A8.8.25 of the ARMv7-A/R Architecture Reference Manual).
This would give you a range of 2^24 bytes, or +/-8MB (given that the immediate has include whether it forwards or backwards). However, all ARM instructions are 4 bytes long, and must be size aligned. Because of this we don't have to worry about the two least significant bits of the address - taking our branch range from +/-8MB to +/-32MB.