Would be nice to mention how to determine those *_OFFSET constants. For reference, on my linux mint (glibc 2.39) system this gives them:

    gdb /lib/x86_64-linux-gnu/libc.so.6 -ex 'p &main_arena' -ex 'p malloc'

Also, can attach to an existing process via:

    sudo gdb -p <PID_OF_PROCESS> -ex 'call (void*) dlopen("/path/to/libheap_explorer.so", 2)' -ex 'p explore_heap()'

If you are using a Mac, heapster is a different but also interesting tool for learning about what goes on inside the heap

https://blackwinghq.com/blog/posts/playing-with-libmalloc/

Can you modify this to listen to a signal (e.g. SIGUSR) instead, for triggering the REPL?