UDS Message Decoder
Paste UDS bytes from a trace and see what they mean: service, sub-function, session, DIDs, routine identifier, SecurityAccess level or NRC, per ISO 14229-1.
Updated This page as Markdown
In short
This decoder parses a UDS request or response from raw hex bytes. It recognises the service identifier, tells request from positive response (SID + 0x40) and negative response (0x7F), decodes sub-functions including the suppressPosRspMsgIndication bit, names diagnostic sessions, resolves standard data identifiers for ReadDataByIdentifier and WriteDataByIdentifier, shows routine identifiers for RoutineControl and seed or key levels for SecurityAccess.
Application-layer bytes without the ISO-TP header. Hex, spaces optional.
Examples
Decoded
Request
5 bytes
- Service
- 0x22 ReadDataByIdentifier
- Data identifiers
- 0xF190 VINDataIdentifier 0xF186 ActiveDiagnosticSessionDataIdentifier
How it works
The decoder applies the rules of ISO 14229-1 to the bytes you paste. The first byte is the service identifier; if it is 0x7F the message is a negative response and the next two bytes are the rejected service and the code. If it is a request SID plus 0x40 it is a positive response. For services that carry a sub-function the second byte is split into the suppress bit and the sub-function value, which is named where the standard defines it: sessions for 0x10, reset types for 0x11, routine actions for 0x31, and seed or key levels for 0x27 (odd levels request a seed, even levels send the key for the preceding seed).
Identifiers are then resolved: two-byte DIDs for 0x22, 0x2A, 0x2E, 0x2F and 0x24 against the standard ranges of ISO 14229-1 Annex C, and two-byte RIDs for 0x31. Whatever remains is shown as data.
How to read the result
Use it when reading traces by hand: a line in a CAN log becomes “SecurityAccess requestSeed level 1” instead of “27 01”. Pay attention to the suppress bit on requests other than TesterPresent; it is sometimes used to hide activity from a diagnostic logger. On positive responses, compare the returned sub-function with the request: an ECU that answers 50 03 to 10 03 confirms the extended session, and the four bytes after it are the P2 and P2* server timings.
Limits
The tool decodes one message, not a conversation, and it does not know your ECU. Manufacturer-specific services (0xBA to 0xBE, 0xC0 to 0xC7 and others), vendor DIDs and routine identifiers need the ODX or CDD description to get names. AutoST loads those files and uses them for naming and for the DID and routine scans.
FAQ
Frequently asked questions
How does the tool tell a request from a response?
A positive response uses the request service identifier plus 0x40: 0x22 becomes 0x62, 0x27 becomes 0x67. A negative response always starts with 0x7F. Everything else is treated as a request. Bytes that are both a valid request SID and a valid response SID do not exist in ISO 14229-1, so the rule is unambiguous.
What is the suppress bit?
Bit 7 of the sub-function byte (0x80). When set, the tester tells the ECU not to send a positive response, only negative ones. 3E 80 is the usual TesterPresent: keep the session alive without flooding the bus with answers.
Why does the decoder only show the first DID of a positive 0x22 response?
A positive ReadDataByIdentifier response carries DID, data, DID, data and so on, but the data lengths are only known from the ODX or CDD description of the ECU. Without that, only the first DID is unambiguous. AutoST uses the ODX or CDD file to split the rest.
Sources
Related pages
- GlossaryUDS (Unified Diagnostic Services)UDS (ISO 14229) is the diagnostic protocol of most automotive ECUs: sessions, services, DIDs and SecurityAccess. What it defines and why it is the first attack surface.
- GlossarySID (Service Identifier)The SID is the first byte of every UDS message and names the service, from 0x10 DiagnosticSessionControl to 0x3E TesterPresent. Ranges, response rule, SID sweeps.
- GlossaryDID (Data Identifier)A DID is the 16-bit identifier UDS uses to address a data record, read with 0x22 and written with 0x2E. Standard ranges from ISO 14229-1 Annex C and writable DIDs.
- Free toolsUDS Negative Response Code DecoderDecode a UDS negative response in a second: paste 7F 27 35 or a bare code and get the ISO 14229 name, the rejected service and what it means on the bench. Full NRC table.
- Free toolsUDS DID Lookup: Standard Data IdentifiersLook up the data identifiers reserved by ISO 14229-1: VIN (F190), active session (F186), software and hardware numbers, fingerprints, OBD and safety ranges.
- PlatformKnow every door into the ECU.AutoST enumerates an ECU over UDS: diagnostic endpoints, sessions, all 255 services and readable DIDs, plus XCP/CCP discovery. Risky services are flagged automatically.
