No idea on what this tool does, but I guess you could emulate what a (terrible) GC does and bruteforce stack and memory for valid pointers. You know which pointers are valid from analyzing the heap management info, hence why this only works for glibc malloc (would have to implement on a case by case basis).
