Service Interaction Protocol
Request Upload
Read-only mirror of 0x34. RequestUpload reads data out of the ECU. Unlike RequestDownload it does not modify memory, so no prior erase (0x31) is needed — but it still requires the PROGRAMMING session and a security unlock.
ECU Memory Upload & Dump Sequence (0x35 ➔ 0x36 ➔ 0x37)
Automated Calibration & Memory Extraction Pipeline
Overview
“The RequestUpload service is used by the client to initiate a data transfer from the server (ECU) to the client.”
The chain: 0x35 RequestUpload → 0x36 TransferData (repeated) → 0x37 RequestTransferExit. In each 0x36 the tester sends only a block counter; the ECU replies (0x76) with the data. The 0x75 response tells you the largest block the ECU will send.
Upload Sequence
Step through the read-from-ECU flow — session, security, request upload, transfer blocks, exit. Try the error scenarios too.
Upload Sequence Runner
Step through the read-from-ECU flow and watch the bytes on the wire.
Enter PROGRAMMING, unlock, request upload, pull blocks, exit.
Press Play or Step to begin the sequence.
Build a Request
Set the data-format and address/length nibbles, the address and size, and the ECU state. The builder assembles the exact request bytes and shows the simulator’s response — a 0x75 acceptance or the precise NRC.
Request Builder
Set the DFI, ALFID, address, size, and ECU state — see the assembled request and the simulator’s exact response.
ECU state
dataFormatIdentifier = 0x00
This simulator ignores the DFI — any value is accepted (none is applied).
addressAndLengthFormatId = 0x44
Assembled request (11 bytes)
Accepted. Source: Application. The DFI (0x00) is ignored by this simulator. Response carries maxNumberOfBlockLength = 0x1000.
ECU response
Message Structure
Inspect each byte of the request, the 0x75 response, and a negative response.
◆ PROTOCOL ANATOMY
0x35 REQUEST UPLOAD
0x35 RESPONSE
Compression & encryption: the dataFormatIdentifier can encode compression (high nibble) and encryption (low nibble), but this simulator ignores the DFI byte entirely — any value is accepted and none is applied. (Note this differs from RequestDownload 0x34, which rejects a non-zero DFI with NRC 0x31.)
Memory Map
Memory Map
RequestUpload reads from a region. Readable regions return 0x75; protected/unknown ones return NRC 0x31. (Regions are ECU-configured; these are illustrative.)
Gaps between regions are unmapped — targeting them returns NRC 0x31 (no region found).
- Start
- 0x00100000
- End
- 0x00200000
- Size · Type
- 1 MB · Flash
- 0x35 here
- 75 (accepted)
Main application firmware. The usual upload source.
Block Transfer Math
Block Transfer Calculator
From the maxNumberOfBlockLength in the 0x75 response, work out how many 0x36 → 0x76 data blocks the ECU sends.
Why minus 2? maxNumberOfBlockLength counts the whole 0x76 response the ECU sends — the response SID and the block-sequence-counter — so usable data per block is maxBlock − 2. The final block is often partial. The 0x75 length-format-identifier for this maxBlock is 0x20 (value 0x200).
Service Dependencies
0x35 negotiates memory boundaries and initiates structured software and memory dumping from ECU to tester. Select a node to inspect interactions.
Session & Security
SID 0x35 RequestUpload Matrix
Permissions by physical memory target across diagnostic sessions. Select a row for details.
| Upload Target & Memory Range | DEFAULT 0x01 | EXTENDED 0x03 | PROGRAMMING 0x02 | Security |
|---|---|---|---|---|
| ✗ | ✓ | ✓ | Level 1 | |
| ✗ | ✓ | ~ | Level 1 | |
| ✗ | ✓ | ✓ | Level 1 | |
| ✗ | ✗ | ✗ | Hard Locked |
Keep the session alive: send TesterPresent (3E 80) every 2–3 seconds during the transfer. If the S3 timer (≈5s) expires, the ECU drops the transfer state and the upload must restart from 0x35.
Requests sent while locked or in Default Session are rejected with NRC 0x33 (SecurityAccessDenied) or NRC 0x7F (ServiceNotSupportedInActiveSession).
ECU prepares memory access pointers, returns the maximum upload block length, and unlocks TransferData (0x36) reads.
| From Session | To Session | Transition Command | Security State Effect |
|---|---|---|---|
| 0x01 Default | 0x02 Programming | Enables programming session state; security access must be unlocked next. | |
| 0x02 Programming | 0x01 Default | Security resets to LOCKED. Active upload session terminated immediately. | |
| Programming | ECU Reset | System resets, active memory extraction pipeline aborts. |
Triggered when this service or requested resource requires an active security unlock that has not been granted.
Triggered during unlock attempts if the calculated key fails ECU cryptographic verification.
Enforced delay lockout if the maximum number of failed key submissions (typically 3) has been exceeded.
Upload vs Download
| Property | RequestUpload (0x35) | RequestDownload (0x34) |
|---|---|---|
| Data direction | ECU → Tester (read) | Tester → ECU (write) |
| Positive response | 0x75 | 0x74 |
| 0x36 request | Block counter only | Block counter + data |
| 0x36 response | ECU sends data | ECU acks counter only |
| maxBlockLength | Max bytes ECU sends/block | Max bytes ECU receives/block |
| DFI handling (this sim) | Ignored (not validated) | Non-zero → NRC 0x31 |
| Prior erase (0x31) | Not needed (read-only) | Typically required |
| Typical use | Read firmware / logs | Flash firmware / calibration |
Complete Upload Sequence
Read Firmware from ECU
15 stepsNegative Response Codes
EXCEPTION_MATRIX_V3
The byte count does not match the ALFID parameter byte specification.
This negative response indicates a rejection while processing the Request Upload (SID 0x35) request. Verify preconditions, session levels, and message formatting per ISO 14229.
Troubleshooting Guide
Troubleshooting Guide
Click any issue to expand diagnosis and resolution.
Timing Parameters
| Parameter | Typical Value | Context |
|---|---|---|
| P2 (Response) | 50 ms | Standard response timeout |
| P2* (Enhanced) | 5000 ms | Session-dependent, set by 0x10 response |
| S3 (Session Timeout) | 5000 ms | Session inactivity limit — send 3E 80 to reset |
| Block read time | 10–50 ms/block | ECU dependent |
ISO 14229-1 References
Standard: ISO 14229-1:2020, Section 14.3 — RequestUpload. Related: §14.4 TransferData (0x36), §14.5 RequestTransferExit (0x37), §14.2 RequestDownload (0x34).
Key points
- dataFormatIdentifier: high nibble = compressionMethod, low nibble = encryptingMethod (this simulator ignores the byte)
- addressAndLengthFormatIdentifier: high nibble = memorySize length, low nibble = memoryAddress length (a 0 nibble → NRC 0x31)
- Positive response lengthFormatIdentifier high nibble = number of bytes in maxNumberOfBlockLength
- maxNumberOfBlockLength includes the 0x76 SID and block-sequence-counter byte
Quick Reference & Best Practices
RequestUpload
mirror of 0x34Transfer sequence
Request
Positive Response
- Service ID
- 0x35
- Positive Response
- 0x75
- Direction
- ECU → Tester (read)
- Required session
- PROGRAMMING (0x02) only
- Security
- Must be unlocked (0x27)
- Min request length
- 5 bytes (SID + DFI + ALFID + addr + size)
- Data format (this sim)
- DFI byte is ignored (not validated/applied)
- ISO ref
- ISO 14229-1:2020 §14.3