How can I attempt to read bad sectors from the end of the disk, using ddrescue?

How can I attempt to read bad sectors from the end of the disk, using ddrescue? I have dynamic volumes and the LDR is kept at the end of the disk, unlike MBR.

I remember that I've tried --reverse but it changed the direction from the last tried position (basically going back towards the starting point, from the first bad sectors found), instead of starting from the end of the disk.

This is the output of head -n 10 mapfile:

# Rescue Logfile. Created by GNU ddrescue version 1.16
# Command line: ddrescue -d -f -r3 /dev/sdb /dev/sda rescue.log
# current_pos  current_status
0x4E39922200   /
# pos       size        status
0x00000000  0x1DF9F200  +
0x1DF9F200  0x00001E00  -
0x1DFA1000  0x45EE0200  +
0x63E81200  0x00000E00  -
0x63E82000  0x00000200  +

_{Preliminary note: your version of ddrescue is 1.16, it's old, released on 2012-06-11. This answer is based on the documentation of the version 1.24.}

These are options you can use to make ddrescue read a particular fragment of the input device or file:

-i bytes
--input-position=bytes
Starting position of the rescue domain in infile, in bytes. Defaults to 0. […]

-s bytes
--size=bytes
Maximum size of the rescue domain in bytes. It limits the amount of input data to be copied. […]

^source

In your case you should specify -i bytes, so the structure you care for is between bytes and the end of the disk. Note ddrescue accepts e.g. 200G or 200Gi (and these are different positions).

Numbers given as arguments to options (positions, sizes, rates, etc) may be expressed as decimal, hexadecimal or octal values (using the same syntax as integer constants in C++), and may be followed by a multiplier and an optional B for "byte". […]

See the documentation, there's a table of possible unit multipliers. According to another part of the documentation hexadecimal (0x…) numbers in a mapfile indicate positions and sizes in bytes, so you can use them in the same form. E.g. to cover only this part of your mapfile

0x1DF9F200  0x00001E00  -

the command should use -i 0x1DF9F200 -s 0x00001E00.

You can use -i and/or -s with the mapfile ddrescue created so far, the existing information should not be lost. Similarly you can run the tool later without these options and its scope (rescue domain) will be the entire device again.