(taken from the documentation of the bootloader)
I assume he really doesn't want to touch the bootloader side.
//bootloader ram array start
uint8_t* const jumpcode = (uint8_t*)0x200027F0;
//existing code can use as before
//array access works fine- jumpcode[n] = 0
//not as perfect as before (4 extra bytes), but compiler may optimize since const)
//bootloader flash variables
#define flashNodeId *(uint8_t*)0x08007F00
#define bitrateIndex *(uint8_t*)0x08007F08
...
You still will need to get at the linker script to make sure those areas are not used by you, unless you already have a custom linker script.