Testability Payload Analysis#
Scope#
Service 0xFF00 /65280, interface version 1, in extracted Java application
v15.3.3-r1 / Y317, build 2018-03-16. The recovered enable preference is false;
native MCU equivalence and deployed listener availability are unspecified.
The code implements 23 methods and one event, not every ID 1…88. Method bindings and nested schemas are in the full catalog. This document focuses on payload byte layouts and boundary behavior. Parser consequences follow the compiled implementation; deployment-specific scheduling, exposure and resource effects remain unspecified.
Framing And Notation#
All sizes below exclude the16-byte SOME/IP header. Multi-byte values are
big-endian, fields concatenate without padding, and uN/iN are unsigned/signed
wire integers. SOME/IP’s header length ispayload bytes+8; full frame ispayload+16.
Instance ID is not a header field. The separate MCU bridge’s250-byte payload cap
must not be imported into this Java RPC service. Its TCP buffer starts at4096
but can grow; that is not a maximum or SOME/IP-TP fragment size.
Define:
T = u8 a || u16be b # 3 bytes
S = u8 B || B UTF-8 bytes # no BOM/NUL termination
A = u8 C || C scalar bytes # capacity5
C = u8 a || S b || A c # no struct-level prefix
Array lengths are encoded body bytes excluding the prefix, not element counts. String lengths are UTF-8 bytes, not characters. Canonical sizes describe ordinary emitted/success layouts, not exact parser-rejection boundaries.
All Method Payloads#
ID dec /hex |
Method |
Canonical Request |
Canonical Success |
Bytes Req /Rsp |
|---|---|---|---|---|
1 /0001 |
checkByteOrder |
u8 operationType, u32 inUINT32, u16 inUINT16 |
u16 carry, u32 sumLow |
7 /6 |
2 /0002 |
echoBool |
bool (00/01) |
same bool |
1 /1 |
3 /0003 |
echoUINT8 |
u8 |
same |
1 /1 |
4 /0004 |
echoUINT16 |
u16 |
same |
2 /2 |
5 /0005 |
echoUINT32 |
u32 |
same |
4 /4 |
6 /0006 |
echoUINT64 |
u64 |
same |
8 /8 |
7 /0007 |
echoSINT8 |
i8 |
same |
1 /1 |
8 /0008 |
echoSINT16 |
i16 |
same |
2 /2 |
9 /0009 |
echoSINT32 |
i32 |
same |
4 /4 |
10 /000A |
echoSINT64 |
i64 |
same |
8 /8 |
13 /000D |
echoInverseStruct |
T |
T: a=low8(input.b), b=input.a |
3 /3 |
16 /0010 |
echoInverseDynamicArray |
u8 L, L scalar bytes;0…5 items |
same layout, reversed item order |
1…6 /1…6 |
19 /0013 |
echoComplexDynamicArray |
u8 L, n*T;L=3n, n=1…5 |
same array values |
4,7,10,13,16 /same |
20 /0014 |
echoUTF8String |
S; canonical B<=96 |
re-encoded S |
1…97 /1…97 |
23 /0017 |
echoComplexStruct |
C; string B<=96, scalar C<=5 |
same values re-encoded |
3…104 /3…104 |
28 /001C |
echoUINT8UINT16UINT32 |
u8,u16,u32 |
same ordered fields |
7 /7 |
31 /001F |
triggerEventUINT8 |
u8 triggerNRetry |
empty server success; client no-return |
1 /0 logically |
32 /0020 |
triggerEchoUINT8 |
u8 |
empty success if callback-client operation succeeds; client no-return |
1 /0 logically |
33 /0021 |
triggerEcho_UINT8_UINT16_UINT32 |
u8,u16,u32 |
empty success if callback succeeds; client no-return |
7 /0 logically |
38 /0026 |
activateTsClient |
u8 startTimeout seconds |
empty success if admitted/connected |
1 /0 |
39 /0027 |
deactivateTsClient |
u8 startTimeout seconds |
empty success if admitted/closed |
1 /0 |
87 /0057 |
echoLargeDataArray |
u16 L, n*T;L=3n, n=0…8191 |
same array values |
2…24575 /same |
88 /0058 |
getLastValueEventUINT8 |
empty in compiled client |
u8 cached callback event value |
0 /1 |
Methods31/32/33 normally use REQUEST_NO_RETURN, so the transport suppresses both success and error replies. No response to them is not, by itself, a crash or parse failure. The server dispatcher does not prove a per-method type allowlist; the table describes compiled client intent. Method88 ignores incoming bytes, although its compiled client sends an empty request.
Fixed-Field Semantics#
Method1 only defines operationType0. Its manager performs addition, not an
endianness negotiation: sum = inUINT32 + inUINT16, carry=sum>>32,
sumLow=sum&FFFFFFFF. A 7-byte request 00 ff ff ff ff 00 01
therefore implies the 6-byte result 00 01 00 00 00 00.
An unknown enum maps toJava null; the manager dereference fails asNOT_OK rather
than being rejected by the enum parser asMALFORMED_MESSAGE.
Method13 exchanges the logical fields with width conversion, not individual
wire bytes. Request 12 34 56 means a=12,b=3456 hex and implies
56 00 12. Signed echoes use two’s complement. UInt64 is eight wire bytes even
though the Java model uses BigInteger. These arithmetic/layout consequences
follow manager someip.d.e.
Variable-Length Validation#
Method |
Prefix |
Capacity / Encoding Limit |
Decode Behavior |
|---|---|---|---|
16 |
u8 byte length |
5 scalar items |
No separate early count check; setter capacity and full-payload bounds can fail |
19 |
u8 byte length |
5 three-byte structs; default count1/null |
No divisibility-by3 or exact declared-array-end check; zero body causes response failure |
20 |
u8 UTF-8 byte length |
Encoder96; decoder can consume255 when available |
97…255-byte strings may parse but fail response serialization |
23 |
u8 string length and u8 scalar-array length |
String encoder96; scalar array5 |
Nominal104 bytes is not decode-time outer cap; parser can consume263 with255-byte string |
87 |
u16 byte length |
8191 three-byte structs |
Same missing exact item-boundary check; canonical maximum24575 payload/24591 full-frame bytes |
Detailed codec behavior is in TESTABILITY_VARIABLE_LENGTH.md. Its important distinction is declared subrange versus full Java payload, not native memory safety. For19/87, element parsing receives the full payload end. A declared one-byte body can therefore consume a three-byteT if all three bytes are available:
method19 input: 01 01 02 03
declared body: 1 byte
parser consumption: 3 body bytes, 4 total
canonical echo: 03 01 02 03
This is not a read outside the full payload array. Too-short actual data or
backing-capacity overflow causes a caught parse exception. The dispatcher also
ignores the returned consumed count, so valid leading data plus trailing bytes
need not be rejected. See decompiled/b/a/c/c/a/d.java:732-747.
Empty Arrays And Strings#
Method16 00, method87 00 00, method20 00, and method23 00 00 00 represent
ordinary empty values and have valid empty-value echoes. Method19 00 differs:
its model’s default logical count remains1 with a null element. Parsing succeeds;
response getSize fails before allocation/serialize, yieldingNOT_OK1. Missing
prefix bytes are never equivalent to zero-length prefixes.
The UTF-8 decoder usesJava replacement behavior, not an explicitly reporting
CharsetDecoder. An isolated invalid 80 can becomeU+FFFD and re-encode as
ef bf bd, changing the echoed length/body. Replacement grouping for arbitrary
malformed sequences depends on Java’s decoder. Length limits count encoded bytes; a string
can parse and then exceed the outgoing96-byte limit. These are re-encoding and
validation asymmetries, not proof of arbitrary code execution.
Event And Stateful Controls#
Event 0x8001 carries exactly one serialized byte, data:u8. Method31 passes
its triggerNRetry byte once as this event value; the name does not correspond
to a retry loop in the manager.
Methods32/33 require an activated callback client and forward echo operations to it. Method88 reads that callback client’s cached last event, initially0, not the local server’s last emitted event. It is neither memory access nor a clock read.
Methods38/39 delay using Thread.sleep(startTimeout*1000), with a u8 range0…255
seconds, and then open/close the callback client. Compiled callback defaults use
local/remote port30600 and remote instance2; preferences may override them. These
ports are not fields in the one-byte RPC payload. The service constructs a
dedicated single-thread executor; service-wide availability impact depends on
runtime scheduling. Deactivation does not directly clear the client reference;
the connection-death callback does, permitting a timing-dependent stale reference.
Activation/deactivation can return custom code 32 (0x20).
No testability method here supplies an arbitrary NV/RAM address, writes the authenticated time, or sets the gateway calendar. The examined methods are echo, event, callback-client and connection-control operations. This is scoped to these 23 implementations, not a firmware-wide no-write statement.
Error Stages#
Assuming an admitted service/interface/header:
Stage |
Error Code |
Examples |
|---|---|---|
Request parser |
9 MALFORMED_MESSAGE |
Too-short scalar/prefix/body, bool other than0/1, backing-array overflow |
Manager or response sizing/serialization |
1 NOT_OK |
Unknown operation enum; method19 empty-array null; echoed string above96 encoded bytes |
Unknown method |
3 UNKNOWN_METHOD |
Unimplemented holes in1…88 |
Callback activation state/connection/delay failure |
32 custom |
Some method38/39 failures; not a TP flag |
Wrong protocol/interface/service are routed separately as7/8/2. Numeric error codes are in the header; this stack clears error payloads to zero bytes. Success and error replies are suppressed for no-return requests. The parser does not guarantee strict full-payload consumption or validation of every nominal DTO limit. Header framing length arithmetic has separate constraints described in the common stack.