We do not know the size of the ROM for certain but, however it is secure enough to just use the size of the firmware file we now have.
So to start, let's start with a place within the code we know will exist.