Service Interaction Protocol
Request Upload
FLOW_TYPE
RETRIEVAL
SESSION_LOCK
Overview
RequestUpload is the counterpart to RequestDownload (0x34). It initiates reading data FROM the ECU. The sequence is: RequestUpload (0x35) → TransferData (0x36) → RequestTransferExit (0x37). The ECU responds with the maximum block size it will send per transfer.
Preparing the ECU to push internal data or firmware images to the tester.
Default Behavior
By default, internal ECU memory is protected from external reading to safeguard IP and security keys. Service 0x35 is typically only available in Extended (0x03) or Programming (0x02) sessions after a successful Security Access (0x27) unlock. A valid request transitions the ECU into an “Uploading” state, freezing the target data in memory to ensure consistency during the sequence.
Interactions with Other SIDs
Prerequisites & Dependencies
- 0x10Programming Session (0x02) or Extended Session (0x03)
- 0x27Security Access often required
- 0x36TransferData retrieves the actual data blocks
- 0x37RequestTransferExit completes the sequence
Protocol Anatomy (Read Calibration)
◆ PROTOCOL ANATOMY
0x35 REQUEST UPLOAD
0x35 RESPONSE
TX/RX Examples
Request Upload 4KB from 0x00100000
Request
35 00 44 00 10 00 00 00 00 10 00> Upload 4096 bytes from flash
Response
75 20 02 00> MaxBlockLength=512 bytes
Read Calibration Data
Request
35 00 44 00 20 00 00 00 00 01 00> Upload 256 bytes of calibration
Response
75 20 01 00> MaxBlockLength=256 bytes
UML Sequence Diagrams
Complete Upload Sequence
Read Firmware from ECU
12 stepsAnticipated Behavior
TransferData Direction: Unlike RequestDownload where the tester sends data in 0x36, with RequestUpload the ECU sends data in the 0x36 response.
Block Sequence: The tester sends sequential block numbers (01, 02, 03…) in TransferData requests. The ECU responds with the corresponding data block.
Negative Response Codes (NRCs)
Error_Catalog