Checksum/End Of Firmware/Arm Cortex/Linker

Hello,

I am looking for help regarding uVision IDE and Toolchain with regards to finding the end of firmware.

What I want to do:
1) Create a BIN file using hex2bin
2) Replace the dummy CRC (ulProgramCrc) at the end of the file with an own written tool
3) Load BIN file into STM32F2
4) Calculate CRC with the "CRC calculation unit" and compare with the image CRC

I tried so fare:

EndOfFirmware.c

#pragma push
#pragma Ono_remove_unused_constdata

// Dieser Wert muss sich am Ende des BIN-Files befinden (Scatterloading) und wird durch ein AfterBuild Tool durch die richtige CRC ersetzt.
// Zum Prüfen wird die interne STM32 CRC calculation unit verwendet.
const unsigned long ulProgramCrc __attribute__((section("FlashEnd"))) = 0xAABBCCDD;

#pragma pop

And the scatter file:

LR_IROM1 0x08020000 0x00020000  {    ; load region size_region
  ER_IROM1 0x08020000 0x00020000  {  ; load address = execution address
   *.o (RESET, +First)
   *(InRoot$$Sections)
   .ANY (+RO)
  }
  RW_IRAM1 0x20000000 0x00018000  {  ; RW data
   .ANY (+RW +ZI)
  }
; ER_IROM2 AlignExpr(ImageLimit(ER_IROM1), 4)  {  ; CRC at the end of the image
; ER_IROM2 0x803FFFC 0x00000004   {  ; CRC at the end of
;  ER_IROM2 AlignExpr(ImageLimit(ER_IROM1), 4)  {  ; CRC at the end of the image
  ER_IROM2 +0 0x00020000   {  ; CRC at the end of the image
   endoffirmware.o ("FlashEnd", +Last)
  }
}

With these settings the ulProgramCrc variable is placed at the end of the bin file, but when I start the debugger &ulProgramCrc is a ram address. I need the flash address, so I know the end of the image!

The other way
... = Image$$ER_IROM1$$Length;
... = Image$$RW_IRAM1$$RW$$Length;
doesn't work. I always get 0xFFFFFFFF.

I'm not familar with scatter files, so please help. Thx very much