@nprofile1q... oh, it's the em|bleu EM9305 (ARC EM7D/ ARCv2). I guess it must be in FLASH aka NVM somewhere between 0x30'0000 and 0x37'FFFF. If I get it right, it must be aligned to an 8 kB block. The thing is that there might also be a custom bootloader in flash that I don't have access to because the binary was extracted on in a different way then directly from the device. So 0x30'0000 (no bootloader) is my guess for know. Maybe it even doesn't matter at all because all code might be relocatable?