diff --git a/docs/firmware_image.md b/docs/firmware_image.md
index fd2e7a79..f9429c07 100644
--- a/docs/firmware_image.md
+++ b/docs/firmware_image.md
@@ -80,15 +80,16 @@ From the bootloader code, we can then retrieve the value of the custom field usi
 uint32_t value;
 uint8_t* ptr = NULL;
 uint16_t tlv = 0x34;
-uint8_t* imageHdr = (uint8_t*)WOLFBOOT_PARTITION_BOOT_ADDRESS; /* WOLFBOOT_PARTITION_UPDATE_ADDRESS */
+uint8_t* imageHdr = (uint8_t*)WOLFBOOT_PARTITION_BOOT_ADDRESS + IMAGE_HEADER_OFFSET;
 uint16_t size = wolfBoot_find_header(imageHdr, tlv, &ptr);
-if (size != sizeof(uint32_t) || ptr == NULL) {
-    /* Error: the field is not present or has the wrong size */
+if (size > 0 && ptr != NULL) {
+  /* Found field and ptr points to value 0xAABBCCDD */
+  memcpy(&value, ptr, size);
+  printf("TLV 0x%x=0x%x\n", tlv, value);
+}
+else {
+    /* Error: the field is not found */
 }
-
-/* From here, the value 0xAABBCCDD is at ptr */
-memcpy(&value, ptr, size);
-printf("TLV 0x%x=0x%x\n", tlv, value);
 ```
 
 ### Image signing tool
diff --git a/include/image.h b/include/image.h
index 9315e02e..5cd397bb 100644
--- a/include/image.h
+++ b/include/image.h
@@ -565,10 +565,6 @@ int wolfBoot_set_update_sector_flag(uint16_t sector, uint8_t newflag);
 uint8_t* wolfBoot_peek_image(struct wolfBoot_image *img, uint32_t offset,
         uint32_t* sz);
 
-
-/* Defined in libwolfboot */
-uint16_t wolfBoot_find_header(uint8_t *haystack, uint16_t type, uint8_t **ptr);
-
 /* get header type for image */
 uint16_t wolfBoot_get_header(struct wolfBoot_image *img, uint16_t type, uint8_t **ptr);
 
diff --git a/include/wolfboot/wolfboot.h b/include/wolfboot/wolfboot.h
index ccdc0da8..e69cbbb1 100644
--- a/include/wolfboot/wolfboot.h
+++ b/include/wolfboot/wolfboot.h
@@ -275,6 +275,8 @@ uint32_t wolfBoot_get_blob_version(uint8_t *blob);
 uint16_t wolfBoot_get_blob_type(uint8_t *blob);
 uint32_t wolfBoot_get_blob_diffbase_version(uint8_t *blob);
 
+uint16_t wolfBoot_find_header(uint8_t *haystack, uint16_t type, uint8_t **ptr);
+
 /* Get partition ID from manifest header */
 static inline uint8_t wolfBoot_get_blob_partition_id(uint8_t *blob) {
     return wolfBoot_get_blob_type(blob) & HDR_IMG_TYPE_PART_MASK;
diff --git a/test-app/app_sim.c b/test-app/app_sim.c
index 598edf03..6890b4f3 100644
--- a/test-app/app_sim.c
+++ b/test-app/app_sim.c
@@ -71,7 +71,8 @@ int do_cmd(const char *cmd)
         exit(0);
     }
     if (strncmp(cmd, "get_tlv",7) == 0) {
-        uint8_t* imageHdr = (uint8_t*)WOLFBOOT_PARTITION_BOOT_ADDRESS;
+        /* boot partition and skip the image header offset (8 bytes) */
+        uint8_t* imageHdr = (uint8_t*)WOLFBOOT_PARTITION_BOOT_ADDRESS + IMAGE_HEADER_OFFSET;
         uint8_t* ptr = NULL;
         uint16_t tlv = 0x34; /* default */
         int size;
@@ -82,20 +83,18 @@ int do_cmd(const char *cmd)
             tlvStr += strlen("get_tlv=");
             tlv = (uint16_t)atoi(tlvStr);
         }
-        printf("Get TLV %04x\r\n", tlv);
 
-        size = wolfBoot_find_header(imageHdr + IMAGE_HEADER_OFFSET, tlv, &ptr);
+        size = wolfBoot_find_header(imageHdr, tlv, &ptr);
         if (size > 0 && ptr != NULL) {
             /* From here, the value 0xAABBCCDD is at ptr */
-            printf("TLV 0x%x: found. Size: %d\n", tlv, size);
+            printf("TLV 0x%x: found (size %d):\n", tlv, size);
             for (i=0; i<size; i++) {
                 printf("%02X", ptr[i]);
             }
             printf("\n");
             return 0;
         } else {
-            printf("TLV: not found!\r\n");
-            return -1;
+            printf("TLV 0x%x: not found!\r\n", tlv);
         }
     }
     /* wrong command */