F28M35H52C1 C28-BootLoader

 Dear support,

We have Concerto F28M35H52C1 Loader M3 that prform M3-application programming. 
But we have to program C28 firmware also and as result of it our loader should be dual (include M3 and C28 parts). 

C28 firmware run from the flash only if its start address = 0x13FFF0.

   FLASH       : origin = 0x100000, length = 0xFFE0
   BEGIN       : origin = 0x13FFF0, length = 0x2

 If I change this address to another one – C28 doesn’t start after booting. 

   FLASH       : origin = 0x100000, length = 0xFFE0
  BEGIN       : origin = 0x10FFE0, length = 0x2

 How to run  C28 firmware with begin-address different from 0x13FFF0? How M3-loader/application know what C28 program to run (our C28 flash include two programs – C28 loader and C28 application)

 Could you help us with it?

 Thanks, Sabina