Simple thing to start with
>>Is there something similar to the ingenious "Array ram = 0" hack taking place in malloc?
C has pointers so it does not need a hack like that. You can simply do
char * ram_base = 0;
You want access to location 42?
char x = ram_base[42];
Now the main question.
All mallocs work in the same way roughly. They have a chunk of memory they get from the base OS, on linux historically obtained via a call to sbrk, while the program is being started.
The mallocs then chop that memory up and hand bits out to callers. Different malloc implementations use more of less sophisticated algorithms. If you want to read about them a good place to start is here
https://en.wikipedia.org/wiki/C_dynamic_memory_allocation scroll down to the section called 'implementations'
Note also that you are getting dangerously close to disappearing down another rabbit hole - memory virtualization and protection. The hack cpu does not support that but all modern OSes are built on top of it. An interesting thought experiment is - what are the minimal changes that need to be made to Hack cpu in order to support robust milti-tasking OS?