mapped out memory using debug info. &hexplorer
i spent quite a while figuring out how to deal with aliasing.
turns out, my test program (almost) doesn't have any aliasing 😄

edit: yeah, no, of course it does. silly little bug.
for anyone interested, i build the mapping in two passes.
first, i collect all unique (ptr, type) pairs by following pointers depth first. (this uses a visited set, which caught the aliasing)
then i sort those by decreasing type size and create the mapping.
sorting makes sure i create mappings for structs before processing pointers to their fields (roughly). which is useful for storing "reverse pointers".