I'd approach this problem as follows: 0. Check for logging strings. Probably you'll find there something related to allocations which will solve the problem.

1. Find all functions with 1 argument (size for malloc and pointer for free)

2. Track results of these functions. malloc result is usually checked against NULL after use and rarely used in math operations. In addition result of malloc function is used in store operations or memcpy.

3. Free function argument is not used after calling it.

4. Malloc and free should be located in close addresses.

These heuristics should be enough to narrow down the number of possible candidates to observable. Good luck.

I'd approach this problem as follows:

0. Check for logging strings. Probably you'll find there something related to allocations which will solve the problem.

1. Find all functions with 1 argument (size for malloc() and pointer for free()).

2. Track results of these functions. malloc() result is usually checked against NULL after use and rarely used in math operations. In addition result of malloc() function is used in store operations or memcpy().

3. Free function argument is not used after calling it.

4. malloc() and free() should be located in close addresses.

These heuristics should be enough to narrow down the number of possible candidates to observable. 

Good luck.