Service Interaction Protocol
Read Memory By Address
Overview
“The ReadMemoryByAddress service is used by the client to request memory data from the server at a specified address with a specified length.”
Common Use Cases
- Reading Calibration Data: Extract ECU tables, maps, and tuning parameters directly from memory.
- Extracting Fault Memory Buffers: Read crash recorder buffers, freeze frame raw traces, and internal stack logs.
- Verifying Firmware Integrity: Verify checksums and binary integrity across non-volatile flash blocks.
- Development & Hardware Bringup: Inspect runtime variables and memory-mapped peripheral registers.
Dependencies & Prerequisites
- Extended Session (0x03): Non-default session required; default session (0x01) rejects all reads.
- Security Access (0x27): Protected memory addresses require active seed-key authentication.
- ALFID Alignment: Address and length format must match ECU architecture (e.g., 32-bit address / 16-bit length).
ALFID Encoding
The Address and Length Format Identifier (ALFID) is a critical byte that specifies how many bytes the ECU should expect for the address and size parameters.
The ALFID byte is split into two nibbles for Length (Bits 7-4) and Address (Bits 3-0).
| ALFID | Address Length | Size Length | Architecture |
|---|---|---|---|
| 0x11 | 1 Byte | 1 Byte | Small 8-bit MCUs |
| 0x22 | 2 Bytes | 2 Bytes | 16-bit addressing |
| 0x44 | 4 Bytes | 4 Bytes | Typical 32-bit systems |
| 0x24 | 4 Bytes | 2 Bytes | 32-bit addr, 64KB max read |
Message Structure
SID 0x23 requests contain the service byte, the AddressAndLengthFormatIdentifier (ALFID), followed by variable-length memory address and size parameters. Click any byte field below or review the structure details.
◆ PROTOCOL ANATOMY
0x23 READ MEMORY BY ADDRESS
0x23 RESPONSE
Session & Security Requirements
SID 0x23 is only available in specific diagnostic sessions. The default session rejects all memory read attempts. Filter and explore the matrix below.
Memory Range Access Matrix
Which physical memory spaces can be read in each session, and required security gates. Select a row for details.
| Memory Space & Address Range | DEFAULT 0x01 | EXTENDED 0x03 | PROGRAMMING 0x02 | Security |
|---|---|---|---|---|
| ✗ | ✓ | ✓ | Level 1 | |
| ✗ | ✓ | ✓ | — | |
| ✗ | ✓ | ✓ | — | |
| ✗ | ✓ | ✓ | Level 1 | |
| ✗ | ✗ | ✗ | Hard Locked |
⏱️ Session Timeout Behavior
- Timeout Duration: Typically 5000ms (5 seconds) after last diagnostic request
- Auto-Reversion: Session automatically reverts to Default (0x01) on timeout
- Timer Reset: Any valid request (including 0x3E Tester Present) resets the timeout
- Long Operations: Use SID 0x3E (Tester Present) every 2-3 seconds to keep session alive
Interactive Session Simulator
Switch between sessions and watch the 5-second timeout countdown. See why NRC 0x22 occurs when session times out.
- 1. Switch Sessions: Click Extended (0x03) to enter diagnostics mode where SID 0x23 is allowed.
- 2. Timer Starts: A 5-second countdown begins. Any valid request resets it.
- 3. Send Requests: Use "Send Request" to simulate sending a request and reset the timer.
- 4. Watch Timeout: If you wait 5 seconds without a request, session reverts to Default automatically.
Security Behavior & Memory Protection
Protected memory regions require Security Access (SID 0x27) before reads are allowed. Security state is hierarchical—unlock Level 1 to access Level 0 & 1 regions.
🔐 Security Timeout & Expiration
- Timeout: Security access expires after 5000ms if no request received
- Session Change: Changing sessions (SID 0x10) clears all security unlocks
- ECU Reset: Any reset returns security to locked state (🔒)
- Multi-Level Security: Each level must be individually unlocked; Level 2 does not auto-unlock Level 1
Interactive Seed-Key Exchange
Perform the seed-key exchange for each security level. Request a seed, calculate the key, and submit it within the 5-second window.
[27 01]Click to start seed request
💡 Each level must be explicitly unlocked. Level 3 unlock does NOT automatically unlock Level 1–2.
Security State Behavior
Unprotected memory addresses (if any public segments are designated) can be read in extended session. Restricted memory ranges strictly return NRC 0x33 (SecurityAccessDenied) if requested when locked.
Reading from protected address spaces (application flash, EEPROM parameters, diagnostic buffers) is permitted within the granted security level.
Triggered when this service or requested resource requires an active security unlock that has not been granted.
Triggered during unlock attempts if the calculated key fails ECU cryptographic verification.
Enforced delay lockout if the maximum number of failed key submissions (typically 3) has been exceeded.
Service Dependencies & Relationships
0x23 retrieves raw memory byte streams from specified physical address ranges. Select a node to inspect interactions.
Service Interaction Workflows
Real-world scenarios showing proper session and security handling. Click through each scenario step-by-step to understand the complete flow.
Extract 256 bytes of public calibration from 0x00100000 after Extended Session upgrade.
Public · 4 frames10 03Enter Extended Session50 03 00 32 01 F4Session Active23 44 00 10 00 00 00 00 01 00Read 256 Bytes63 AA BB CC DD EE FF 11 22 33 …256 Bytes ReturnedPress Simulate to animate the full message sequence.
Timing Parameters
Understanding ECU Response Timing:
- P2 (standard response): 50ms — normal request/response cycle
- P2* (enhanced response): 5000ms — for slow operations (memory reads from flash)
- Session timeout: 5000ms — reset on any valid request or keep-alive (0x3E)
- Security timeout: 5000ms — from seed request to key submission
- Maximum single read: 4095 bytes (depends on ECU buffer size)
Interactive Timing Diagram
Watch a 4KB read operation unfold in real time (or 4x/8x speed). See where keep-alive messages are needed and how timeout is prevented.
This scenario shows reading 4KB of data. The operation would take ~1 second if uninterrupted. However, S3 timeout fires after 5 seconds of inactivity. The diagram shows:
- Session entered at 0.2s (starts 5s timeout counter)
- Read request sent at 1.0s (resets timeout)
- Keep-alive sent at 2.0s and 4.0s (keeps session alive)
- Read completes at 5.2s (before timeout at 5.2s mark)
- Without keep-alives, timeout would fire at 5.2s and revert session
Address Validation Rules
Before reading memory, the ECU validates the address range against the memory map. Understanding these rules prevents NRC 0x31 errors.
| Validation Check | Condition | Failure Response |
|---|---|---|
| Size is valid | Size must be > 0 | NRC 0x31 |
| No overflow | Address + Size must not wrap around | NRC 0x31 |
| Region found | Address must fall in a readable memory region | NRC 0x31 |
| Single region | Address range must not span multiple regions | NRC 0x31 |
| Region readable | Memory region must have read permission | NRC 0x31 |
Interactive Address Validator
Enter a start address and byte count to test if the read is valid. Watch the memory map visualize your requested range and check for boundary violations.
= 1048576 decimal
= 256 decimal
Valid read range. No security unlock required.
ECU Memory Map Explorer
Different ECU architectures have different memory layouts. Use this explorer to understand the memory map of various ECU types and where SID 0x23 can and cannot read.
Flash Program
0x00008000 – 0x0000FFFF
EEPROM
0x00004000 – 0x0000407F
RAM
0x00000000 – 0x00001FFF
- Click a region to see its address range and security requirements
- Use ALFID 0x11 for SID 0x23 requests on this architecture
- Each region shown requires different security levels; check before reading
- Real ECUs may have different memory maps; always verify with the data sheet
Negative Response Codes
EXCEPTION_MATRIX_V3
AddressAndLengthFormatIdentifier (ALFID) byte does not match the actual byte length provided in the PDU.
This negative response indicates a rejection while processing the Read Memory By Address (SID 0x23) request. Verify preconditions, session levels, and message formatting per ISO 14229.
Troubleshooting Common Issues
NRC Decoder Tool
Paste a negative response hex (e.g., “7F 23 22”) to decode the NRC and see root cause analysis with step-by-step fixes.
Format: "7F 23 XX" where XX is the NRC code. Spaces optional.
❌ Intermittent NRC 0x22 (Conditions Not Correct)
Root Causes to Check:
- Session Timeout: No request sent for 5+ seconds → session reverts to Default (0x01).
💡 Fix: Send [3E 80] (Tester Present) every 2-3 seconds - Voltage Issue: ECU power supply unstable.
💡 Fix: Stabilize power supply to ECU - ECU Busy: ECU performing other critical operation.
💡 Fix: Wait 100-500ms and retry
❌ NRC 0x31 on What Looks Like Valid Address
Root Causes to Check:
- Region Boundary Crossing: Read spans two memory regions (Flash → Calibration).
💡 Fix: Keep read within single region; split into two reads at boundary - Integer Overflow: Address + Size wraps around (e.g., 0xFFFFFFF0 + 0x20).
💡 Fix: Reduce size or use lower address - Vendor Memory Map: ECU has custom reserved regions not in standard layout.
💡 Fix: Consult ECU memory map documentation
❌ NRC 0x33 Persists After Security Unlock
Root Causes to Check:
- Security Timeout Expired: Too much time between seed request and key submission (5s limit).
💡 Fix: Speed up key calculation or request new seed - Wrong Security Level: Memory needs Level 2, but only Level 1 is unlocked.
💡 Fix: Perform [27 03] [27 04] for Level 2 unlock - Session Changed: [10 xx] was called after security unlock → cleared all locks.
💡 Fix: Don’t change sessions; if needed, re-unlock after change