I suppose this is the simplest way of finding malloc() as IOS tells you exactly where it is!
Does do a ‘show mem’, and IOS gives you the ‘Alloc PC’ which is the address of the callsite where malloc is called. There are quite a number (nearly 20) of these mallocs, all of them calling a common function _malloc (or whatever you want to call it) but with slightly different arguments. The malloc wrappers also provide the Alloc PC address as an argument (which is derived from the return address) to _malloc.
I guess finding malloc is just a matter of reading an address provided by IOS!