.flash file is not a standard SREC file!
I've realized a secondary bootloader that transfers "epcs_controller_boot_rom.flash" to the nios system ram via PCI-bus.
In my design, reset vector is set to epcs-device and exception vector is assigned to system ram. I've figured out that the address field of this .flash file is only a counter which has nothing to do with a storage address. The start address of the different sections are part of the srec
data fields. A .flash S3 record starts with a size indicator (two characters just behind "S3") followed by a 8 character number in big endian format (a counter). The following data fields are organized as 8 character of 32bit data words in little endian format.
The first Data word is a length indicator, the second data word is the target address. the rest are data words to be placed at target address. The length indicator counts bytes. Every line is terminated with a two character checksum as usual in SREC files.
In my design the first data block consists of 12 Bytes (0x0C000000 in little endian) to be placed at address 0x00000000 (the reset start address). The next data block has 68612 Bytes (0x040C0100 in little endian) and has to be stored at address 0x00100020 which is the exception start vector in system ram. The third block in the .flash file has a length of 0 and an address that is the start address of the .text segment e.g. the start of the firmware.
The boot loader is only added when 'FLASH PROGRAMMER' is launched. This program generates a new .flash file, named as specified in the custom board design and obviously consists of Bootloader, Firmware and FPGA-Bitstream. I did not figure out how this file is organized.