Service Interaction Protocol
Read Memory By Address
Overview
“The ReadMemoryByAddress service is used by the client to request memory data from the server at a specified address with a specified length.”
Use Cases
- Reading calibration data
- Extracting fault memory buffers
- Verifying firmware code integrity
- Development and debugging
Dependencies
- Extended Session (0x03) usually required
- Security Access (0x27) for protected regions
- ALFID must match ECU memory architecture
When to Use SID 0x23 vs. Alternatives
| Attribute | 0x23 | 0x22 | 0x34 |
|---|---|---|---|
| Read Type | 📦 Raw | 📋 Structured | 📦 Raw |
| Complexity | 🔴 high | 🟢 low | 🔴 high |
| Default Session | ✗ No | ✓ Yes | ✗ No |
| Max Read Size | ~4KB | ~512B | ∞ (chunked) |
Use 0x23 (Read Memory): When you know the exact memory address (from data sheet or debugger) and need raw bytes. Best for firmware verification, calibration extraction, and low-level debugging.
Use 0x22 (Read DID): When you want structured data (VIN, ECU ID, sensor values) without knowing memory layout. Best for production diagnostics and when memory addresses are unknown.
Use 0x34 (Download): For bulk firmware transfers. More efficient than repeated 0x23 reads; handles fragmentation automatically.
ALFID Encoding
The Address and Length Format Identifier (ALFID) is a critical byte that specifies how many bytes the ECU should expect for the address and size parameters.
The ALFID byte is split into two nibbles for Length (Bits 7-4) and Address (Bits 3-0).
ALFID | Address Length | Size Length | Architecture |
|---|---|---|---|
| 0x11 | 1 Byte | 1 Byte | Small 8-bit MCUs |
| 0x22 | 2 Bytes | 2 Bytes | 16-bit addressing |
| 0x44 | 4 Bytes | 4 Bytes | Typical 32-bit systems |
| 0x24 | 4 Bytes | 2 Bytes | 32-bit addr, 64KB max read |
Message Format
Request Structure
Byte | Field | Value | Description |
|---|---|---|---|
| 0 | SID | 0x23 | Read Memory By Address |
| 1 | ALFID | 0xNN | Specifies format of next fields |
| 2-N | Address | Variable | Memory address to read |
| N+1-M | Size | Variable | Number of bytes to read |
Response Structure
Byte | Field | Value | Description |
|---|---|---|---|
| 0 | Response SID | 0x63 | Positive Response |
| 1-N | Data Record | Variable | Requested memory content |
Interactive Message Constructor
Build a valid request message by selecting ALFID and entering memory address and size. See the hex output update in real time.
Request Examples
32-bit Standard Read
Request
23 44 00 10 20 30 00 00 00 10> Read 16 bytes (0x10) from 0x00102030
Response
63 AA BB CC DD EE FF 11 22 33 44 55 66 77 88 99 00> Memory Data returned
Short Address Format
Request
23 22 10 00 00 04> ALFID 0x22: 2-byte addr, 2-byte size
Response
63 12 34 56 78> 4 bytes returned
Session State Requirements
SID 0x23 is only available in specific diagnostic sessions. Default session rejects all memory read attempts.
Session Type | SID 0x23 Allowed? | Security Available? | Typical Use Case |
|---|---|---|---|
| Default (0x01) | ✗ No | ✗ No | Post-reset state; no memory access |
| Extended (0x03) | ✓ Yes | ✓ Yes | Standard diagnostics; most reads here |
| Programming (0x02) | ✓ Yes | ✓ Yes (Level 0-3) | Firmware/calibration programming |
⏱️ Session Timeout Behavior
- Timeout Duration: Typically 5000ms (5 seconds) after last diagnostic request
- Auto-Reversion: Session automatically reverts to Default (0x01) on timeout
- Timer Reset: Any valid request (including 0x3E Tester Present) resets the timeout
- Long Operations: Use SID 0x3E (Tester Present) every 2-3 seconds to keep session alive
Interactive Session Simulator
Switch between sessions and watch the 5-second timeout countdown. See why NRC 0x22 occurs when session times out.
- 1. Switch Sessions: Click Extended (0x03) to enter diagnostics mode where SID 0x23 is allowed.
- 2. Timer Starts: A 5-second countdown begins. Any valid request resets it.
- 3. Send Requests: Use "Send Request" to simulate sending a request and reset the timer.
- 4. Watch Timeout: If you wait 5 seconds without a request, session reverts to Default automatically.
Security Behavior & Memory Protection
Protected memory regions require Security Access (SID 0x27) before reads are allowed. Security state is hierarchical—unlock Level 1 to access Level 0 & 1 regions.
Security Level Requirements by Region
Memory Region | Security Level | Unlock Command | Access Requirements |
|---|---|---|---|
| Public Calibration | Level 0 | None | Extended Session only |
| Flash Code (OEM) | Level 1 | SID 0x27 0x01/0x02 | Extended Session + Unlock |
| OEM Calibration | Level 1 | SID 0x27 0x01/0x02 | Extended Session + Unlock |
| Security Keys | Level 2 | SID 0x27 0x03/0x04 | Programming Session + Unlock |
| Bootloader | Level 3 | SID 0x27 0x05/0x06 | Programming Session + Unlock |
🔐 Security Timeout & Expiration
- Timeout: Security access expires after 5000ms if no request received
- Session Change: Changing sessions (SID 0x10) clears all security unlocks
- ECU Reset: Any reset returns security to locked state (🔒)
- Multi-Level Security: Each level must be individually unlocked; Level 2 does not auto-unlock Level 1
Interactive Seed-Key Exchange
Perform the seed-key exchange for each security level. Request a seed, calculate the key, and submit it within the 5-second window.
[27 01]Click to start seed request
💡 Each level must be explicitly unlocked. Level 3 unlock does NOT automatically unlock Level 1–2.
Service Dependencies & Relationships
SID 0x23 integrates with other services to enable complete memory diagnostics. Understanding these relationships is key to building robust workflows.
SID | Service | Relationship | Purpose |
|---|---|---|---|
| 0x10 | Diagnostic Session Control | REQUIRED | Switch to Extended (0x03) or Programming (0x02) session first |
| 0x27 | Security Access | CONDITIONAL | Unlock protected memory regions via seed-key exchange |
| 0x3E | Tester Present | SUPPORTING | Send periodically (every 2-3s) to prevent session timeout during long operations |
| 0x3D | Write Memory By Address | COMPLEMENTARY | Read-Modify-Write workflows; opposite operation of 0x23 |
| 0x22 | Read Data By Identifier | ALTERNATIVE | Structured read by DID; use when memory layout unknown |
| 0x34 | Request Download | ALTERNATIVE | Bulk download for large firmware; more efficient for huge transfers |
📊 Typical Call Sequence
Complete Workflow Examples
Real-world scenarios showing proper session and security handling. Click through each scenario step-by-step to understand the complete flow.
Goal
Extract 256 bytes of public calibration from 0x00100000
Precondition
ECU in Default Session
- Select a scenario to see how requests and responses flow
- Click Play to step through the workflow at your pace
- Read the notes for each message to understand timing and state changes
- Try all three scenarios to learn: public reads, security unlocks, and timeout handling
Timing Parameters
Understanding ECU Response Timing:
- P2 (standard response): 50ms — normal request/response cycle
- P2* (enhanced response): 5000ms — for slow operations (memory reads from flash)
- Session timeout: 5000ms — reset on any valid request or keep-alive (0x3E)
- Security timeout: 5000ms — from seed request to key submission
- Maximum single read: 4095 bytes (depends on ECU buffer size)
Interactive Timing Diagram
Watch a 4KB read operation unfold in real time (or 4x/8x speed). See where keep-alive messages are needed and how timeout is prevented.
This scenario shows reading 4KB of data. The operation would take ~1 second if uninterrupted. However, S3 timeout fires after 5 seconds of inactivity. The diagram shows:
- Session entered at 0.2s (starts 5s timeout counter)
- Read request sent at 1.0s (resets timeout)
- Keep-alive sent at 2.0s and 4.0s (keeps session alive)
- Read completes at 5.2s (before timeout at 5.2s mark)
- Without keep-alives, timeout would fire at 5.2s and revert session
Negative Response Codes
EXCEPTION_MATRIX_V3
The request message length does not match the ALFID specification, or ALFID nibbles are invalid (must be 1-15).
This negative response indicates a failure in processing the Read Memory By Address request. Ensure all pre-conditions and active sessions match the requirements defined by ISO 14229.
Troubleshooting Common Issues
NRC Decoder Tool
Paste a negative response hex (e.g., “7F 23 22”) to decode the NRC and see root cause analysis with step-by-step fixes.
Format: "7F 23 XX" where XX is the NRC code. Spaces optional.
❌ Intermittent NRC 0x22 (Conditions Not Correct)
Root Causes to Check:
- Session Timeout: No request sent for 5+ seconds → session reverts to Default (0x01).
💡 Fix: Send [3E 80] (Tester Present) every 2-3 seconds - Voltage Issue: ECU power supply unstable.
💡 Fix: Stabilize power supply to ECU - ECU Busy: ECU performing other critical operation.
💡 Fix: Wait 100-500ms and retry
❌ NRC 0x31 on What Looks Like Valid Address
Root Causes to Check:
- Region Boundary Crossing: Read spans two memory regions (Flash → Calibration).
💡 Fix: Keep read within single region; split into two reads at boundary - Integer Overflow: Address + Size wraps around (e.g., 0xFFFFFFF0 + 0x20).
💡 Fix: Reduce size or use lower address - Vendor Memory Map: ECU has custom reserved regions not in standard layout.
💡 Fix: Consult ECU memory map documentation
❌ NRC 0x33 Persists After Security Unlock
Root Causes to Check:
- Security Timeout Expired: Too much time between seed request and key submission (5s limit).
💡 Fix: Speed up key calculation or request new seed - Wrong Security Level: Memory needs Level 2, but only Level 1 is unlocked.
💡 Fix: Perform [27 03] [27 04] for Level 2 unlock - Session Changed: [10 xx] was called after security unlock → cleared all locks.
💡 Fix: Don’t change sessions; if needed, re-unlock after change
Address Validation Rules
Before reading memory, the ECU validates the address range against the memory map. Understanding these rules prevents NRC 0x31 errors.
Validation Check | Condition | Failure Response |
|---|---|---|
| Size is valid | Size must be > 0 | NRC 0x31 |
| No overflow | Address + Size must not wrap around | NRC 0x31 |
| Region found | Address must fall in a readable memory region | NRC 0x31 |
| Single region | Address range must not span multiple regions | NRC 0x31 |
| Region readable | Memory region must have read permission | NRC 0x31 |
Interactive Address Validator
Enter a start address and byte count to test if the read is valid. Watch the memory map visualize your requested range and check for boundary violations.
= 1048576 decimal
= 256 decimal
Valid read range. No security unlock required.
ECU Memory Map Explorer
Different ECU architectures have different memory layouts. Use this explorer to understand the memory map of various ECU types and where SID 0x23 can and cannot read.
Flash Program
0x00008000 – 0x0000FFFF
EEPROM
0x00004000 – 0x0000407F
RAM
0x00000000 – 0x00001FFF
- Click a region to see its address range and security requirements
- Use ALFID 0x11 for SID 0x23 requests on this architecture
- Each region shown requires different security levels; check before reading
- Real ECUs may have different memory maps; always verify with the data sheet