EPCQL512 and Remote Update IP ARRIA 10

Hello, 

In the remote update IP for Arria 10, it is stated that we can put the address of the user image at address 0x0 to 0x1F. However I am confused because : 

1. I assume that would be the byte address of the user program,but the byte address is only 4 bytes or 32 bits?
2. When I try to just write the 32bits to bytes 0=>3, and put the generated rpd of the image (using the sof => .jic + rpd conversion), this doesn't work at all.
3. Is there a map on how the RPD file is generated? like what are those 0x56565656 we can see repeating everywhere?