The BSS start symbol (as well as some others) is defined by the linker. You can define it like this (char or unsigned char as you wish):

extern char __bss_start[];  

Then you are able to access the bss and get bss start address:

    char c = __bss_start[0];     
    char* p = &__bss_start[0];  

---