diff --git a/app/src/main/jni/netguard/dhcp.c b/app/src/main/jni/netguard/dhcp.c
index d4bb7212..d8d3194c 100644
--- a/app/src/main/jni/netguard/dhcp.c
+++ b/app/src/main/jni/netguard/dhcp.c
@@ -53,7 +53,7 @@ int check_dhcp(const struct arguments *args, const struct udp_session *u,
     // Ack: source: 10.1.10.1 destination: 255.255.255.255
 
     if (request->opcode == 1) { // Discover/request
-        struct dhcp_packet *response = calloc(500, 1);
+        struct dhcp_packet *response = ng_calloc(500, 1);
 
         // Hack
         inet_pton(AF_INET, "10.1.10.1", (void *) &u->saddr);
@@ -136,7 +136,7 @@ int check_dhcp(const struct arguments *args, const struct udp_session *u,
 
         write_udp(args, u, (uint8_t *) response, 500);
 
-        free(response);
+        ng_free(response);
     }
 
     return 0;
diff --git a/app/src/main/jni/netguard/icmp.c b/app/src/main/jni/netguard/icmp.c
index 1c60d96c..9f444e1e 100644
--- a/app/src/main/jni/netguard/icmp.c
+++ b/app/src/main/jni/netguard/icmp.c
@@ -83,7 +83,7 @@ void check_icmp_socket(const struct arguments *args, const struct epoll_event *e
             s->icmp.time = time(NULL);
 
             uint16_t blen = (uint16_t) (s->icmp.version == 4 ? ICMP4_MAXMSG : ICMP6_MAXMSG);
-            uint8_t *buffer = malloc(blen);
+            uint8_t *buffer = ng_malloc(blen);
             ssize_t bytes = recv(s->socket, buffer, blen, 0);
             if (bytes < 0) {
                 // Socket error
@@ -136,7 +136,7 @@ void check_icmp_socket(const struct arguments *args, const struct epoll_event *e
                 if (write_icmp(args, &s->icmp, buffer, (size_t) bytes) < 0)
                     s->icmp.stop = 1;
             }
-            free(buffer);
+            ng_free(buffer);
         }
     }
 }
@@ -185,7 +185,7 @@ jboolean handle_icmp(const struct arguments *args,
         log_android(ANDROID_LOG_INFO, "ICMP new session from %s to %s", source, dest);
 
         // Register session
-        struct ng_session *s = malloc(sizeof(struct ng_session));
+        struct ng_session *s = ng_malloc(sizeof(struct ng_session));
         s->protocol = (uint8_t) (version == 4 ? IPPROTO_ICMP : IPPROTO_ICMPV6);
 
         s->icmp.time = time(NULL);
@@ -208,7 +208,7 @@ jboolean handle_icmp(const struct arguments *args,
         // Open UDP socket
         s->socket = open_icmp_socket(args, &s->icmp);
         if (s->socket < 0) {
-            free(s);
+            ng_free(s);
             return 0;
         }
 
@@ -306,7 +306,7 @@ ssize_t write_icmp(const struct arguments *args, const struct icmp_session *cur,
     // Build packet
     if (cur->version == 4) {
         len = sizeof(struct iphdr) + datalen;
-        buffer = malloc(len);
+        buffer = ng_malloc(len);
         struct iphdr *ip4 = (struct iphdr *) buffer;
         if (datalen)
             memcpy(buffer + sizeof(struct iphdr), data, datalen);
@@ -325,7 +325,7 @@ ssize_t write_icmp(const struct arguments *args, const struct icmp_session *cur,
         ip4->check = ~calc_checksum(0, (uint8_t *) ip4, sizeof(struct iphdr));
     } else {
         len = sizeof(struct ip6_hdr) + datalen;
-        buffer = malloc(len);
+        buffer = ng_malloc(len);
         struct ip6_hdr *ip6 = (struct ip6_hdr *) buffer;
         if (datalen)
             memcpy(buffer + sizeof(struct ip6_hdr), data, datalen);
@@ -363,7 +363,7 @@ ssize_t write_icmp(const struct arguments *args, const struct icmp_session *cur,
     } else
         log_android(ANDROID_LOG_WARN, "ICMP write error %d: %s", errno, strerror(errno));
 
-    free(buffer);
+    ng_free(buffer);
 
     if (res != len) {
         log_android(ANDROID_LOG_ERROR, "write %d/%d", res, len);
diff --git a/app/src/main/jni/netguard/ip.c b/app/src/main/jni/netguard/ip.c
index d60d5a95..d8651dae 100644
--- a/app/src/main/jni/netguard/ip.c
+++ b/app/src/main/jni/netguard/ip.c
@@ -53,10 +53,10 @@ int check_tun(const struct arguments *args,
 
     // Check tun read
     if (ev->events & EPOLLIN) {
-        uint8_t *buffer = malloc(get_mtu());
+        uint8_t *buffer = ng_malloc(get_mtu());
         ssize_t length = read(args->tun, buffer, get_mtu());
         if (length < 0) {
-            free(buffer);
+            ng_free(buffer);
 
             log_android(ANDROID_LOG_ERROR, "tun %d read error %d: %s",
                         args->tun, errno, strerror(errno));
@@ -81,10 +81,10 @@ int check_tun(const struct arguments *args,
             // Handle IP from tun
             handle_ip(args, buffer, (size_t) length, epoll_fd, sessions, maxsessions);
 
-            free(buffer);
+            ng_free(buffer);
         } else {
             // tun eof
-            free(buffer);
+            ng_free(buffer);
 
             log_android(ANDROID_LOG_ERROR, "tun %d empty read", args->tun);
             report_exit(args, "tun %d empty read", args->tun);
@@ -483,9 +483,9 @@ jint get_uid_sub(const int version, const int protocol,
 
             if (c >= uid_cache_size) {
                 if (uid_cache_size == 0)
-                    uid_cache = malloc(sizeof(struct uid_cache_entry));
+                    uid_cache = ng_malloc(sizeof(struct uid_cache_entry));
                 else
-                    uid_cache = realloc(uid_cache,
+                    uid_cache = ng_realloc(uid_cache,
                                         sizeof(struct uid_cache_entry) *
                                         (uid_cache_size + 1));
                 c = uid_cache_size;
diff --git a/app/src/main/jni/netguard/netguard.c b/app/src/main/jni/netguard/netguard.c
index c18d79b0..fe0c8100 100644
--- a/app/src/main/jni/netguard/netguard.c
+++ b/app/src/main/jni/netguard/netguard.c
@@ -100,7 +100,7 @@ void JNI_OnUnload(JavaVM *vm, void *reserved) {
 JNIEXPORT jlong JNICALL
 Java_eu_faircode_netguard_ServiceSinkhole_jni_1init(
         JNIEnv *env, jobject instance, jint sdk) {
-    struct context *ctx = calloc(1, sizeof(struct context));
+    struct context *ctx = ng_calloc(1, sizeof(struct context));
     ctx->sdk = sdk;
 
     loglevel = ANDROID_LOG_WARN;
@@ -155,7 +155,7 @@ Java_eu_faircode_netguard_ServiceSinkhole_jni_1run(
                     errno, strerror(errno));
 
     // Get arguments
-    struct arguments *args = malloc(sizeof(struct arguments));
+    struct arguments *args = ng_malloc(sizeof(struct arguments));
     args->env = env;
     args->instance = instance;
     args->tun = tun;
@@ -329,11 +329,11 @@ Java_eu_faircode_netguard_ServiceSinkhole_jni_1done(
             log_android(ANDROID_LOG_ERROR, "Close pipe error %d: %s", errno, strerror(errno));
 
     if (uid_cache != NULL)
-        free(uid_cache);
+        ng_free(uid_cache);
     uid_cache_size = 0;
     uid_cache = NULL;
 
-    free(ctx);
+    ng_free(ctx);
 }
 
 // JNI Util
@@ -898,3 +898,20 @@ void account_usage(const struct arguments *args, jint version, jint protocol,
         log_android(ANDROID_LOG_WARN, "log_packet %f", mselapsed);
 #endif
 }
+
+void *ng_malloc(size_t __byte_count) {
+    return malloc(__byte_count);
+}
+
+void *ng_calloc(size_t __item_count, size_t __item_size) {
+    return calloc(__item_count, __item_size);
+}
+
+void *ng_realloc(void *__ptr, size_t __byte_count) {
+    return realloc(__ptr, __byte_count);
+}
+
+void ng_free(void *__ptr) {
+    free(__ptr);
+}
+
diff --git a/app/src/main/jni/netguard/netguard.h b/app/src/main/jni/netguard/netguard.h
index f86ffde9..0a5c1ce1 100644
--- a/app/src/main/jni/netguard/netguard.h
+++ b/app/src/main/jni/netguard/netguard.h
@@ -551,3 +551,11 @@ int is_readable(int fd);
 int is_writable(int fd);
 
 long long get_ms();
+
+void *ng_malloc(size_t __byte_count);
+
+void *ng_calloc(size_t __item_count, size_t __item_size);
+
+void *ng_realloc(void *__ptr, size_t __byte_count);
+
+void ng_free(void *__ptr);
diff --git a/app/src/main/jni/netguard/pcap.c b/app/src/main/jni/netguard/pcap.c
index 403f5429..f01c2c24 100644
--- a/app/src/main/jni/netguard/pcap.c
+++ b/app/src/main/jni/netguard/pcap.c
@@ -42,7 +42,7 @@ void write_pcap_rec(const uint8_t *buffer, size_t length) {
 
     size_t plen = (length < pcap_record_size ? length : pcap_record_size);
     size_t rlen = sizeof(struct pcaprec_hdr_s) + plen;
-    struct pcaprec_hdr_s *pcap_rec = malloc(rlen);
+    struct pcaprec_hdr_s *pcap_rec = ng_malloc(rlen);
 
     pcap_rec->ts_sec = (guint32_t) ts.tv_sec;
     pcap_rec->ts_usec = (guint32_t) (ts.tv_nsec / 1000);
@@ -53,7 +53,7 @@ void write_pcap_rec(const uint8_t *buffer, size_t length) {
 
     write_pcap(pcap_rec, rlen);
 
-    free(pcap_rec);
+    ng_free(pcap_rec);
 }
 
 void write_pcap(const void *ptr, size_t len) {
diff --git a/app/src/main/jni/netguard/session.c b/app/src/main/jni/netguard/session.c
index 1fabfc83..6713880d 100644
--- a/app/src/main/jni/netguard/session.c
+++ b/app/src/main/jni/netguard/session.c
@@ -29,7 +29,7 @@ void clear(struct context *ctx) {
             clear_tcp_data(&s->tcp);
         struct ng_session *p = s;
         s = s->next;
-        free(p);
+        ng_free(p);
     }
     ctx->ng_session = NULL;
 }
@@ -160,7 +160,7 @@ void *handle_events(void *a) {
                     s = s->next;
                     if (c->protocol == IPPROTO_TCP)
                         clear_tcp_data(&c->tcp);
-                    free(c);
+                    ng_free(c);
                 } else {
                     sl = s;
                     s = s->next;
@@ -276,7 +276,7 @@ void *handle_events(void *a) {
                     "epoll close error %d: %s", errno, strerror(errno));
 
     // Cleanup
-    free(args);
+    ng_free(args);
 
     log_android(ANDROID_LOG_WARN, "Stopped events tun=%d", args->tun);
     return NULL;
@@ -337,7 +337,7 @@ void check_allowed(const struct arguments *args) {
 
                 struct ng_session *c = s;
                 s = s->next;
-                free(c);
+                ng_free(c);
                 continue;
             }
 
diff --git a/app/src/main/jni/netguard/tcp.c b/app/src/main/jni/netguard/tcp.c
index 69222090..8724b467 100644
--- a/app/src/main/jni/netguard/tcp.c
+++ b/app/src/main/jni/netguard/tcp.c
@@ -31,8 +31,8 @@ void clear_tcp_data(struct tcp_session *cur) {
     while (s != NULL) {
         struct segment *p = s;
         s = s->next;
-        free(p->data);
-        free(p);
+        ng_free(p->data);
+        ng_free(p);
     }
 }
 
@@ -328,7 +328,7 @@ void check_tcp_socket(const struct arguments *args,
                     } else {
                         char *h = hex(buffer, (const size_t) bytes);
                         log_android(ANDROID_LOG_INFO, "%s recv SOCKS5 %s", session, h);
-                        free(h);
+                        ng_free(h);
 
                         if (s->tcp.socks5 == SOCKS5_HELLO &&
                             bytes == 2 && buffer[0] == 5) {
@@ -395,7 +395,7 @@ void check_tcp_socket(const struct arguments *args,
                 char *h = hex(buffer, sizeof(buffer));
                 log_android(ANDROID_LOG_INFO, "%s sending SOCKS5 hello: %s",
                             session, h);
-                free(h);
+                ng_free(h);
                 ssize_t sent = send(s->socket, buffer, sizeof(buffer), MSG_NOSIGNAL);
                 if (sent < 0) {
                     log_android(ANDROID_LOG_ERROR, "%s send SOCKS5 hello error %d: %s",
@@ -418,7 +418,7 @@ void check_tcp_socket(const struct arguments *args,
                 char *h = hex(buffer, len);
                 log_android(ANDROID_LOG_INFO, "%s sending SOCKS5 auth: %s",
                             session, h);
-                free(h);
+                ng_free(h);
                 ssize_t sent = send(s->socket, buffer, len, MSG_NOSIGNAL);
                 if (sent < 0) {
                     log_android(ANDROID_LOG_ERROR,
@@ -446,7 +446,7 @@ void check_tcp_socket(const struct arguments *args,
                 char *h = hex(buffer, len);
                 log_android(ANDROID_LOG_INFO, "%s sending SOCKS5 connect: %s",
                             session, h);
-                free(h);
+                ng_free(h);
                 ssize_t sent = send(s->socket, buffer, len, MSG_NOSIGNAL);
                 if (sent < 0) {
                     log_android(ANDROID_LOG_ERROR,
@@ -506,8 +506,8 @@ void check_tcp_socket(const struct arguments *args,
 
                             struct segment *p = s->tcp.forward;
                             s->tcp.forward = s->tcp.forward->next;
-                            free(p->data);
-                            free(p);
+                            ng_free(p->data);
+                            ng_free(p);
                         } else {
                             log_android(ANDROID_LOG_WARN,
                                         "%s partial send %u/%u",
@@ -557,7 +557,7 @@ void check_tcp_socket(const struct arguments *args,
 
                     uint32_t buffer_size = (send_window > s->tcp.mss
                                             ? s->tcp.mss : send_window);
-                    uint8_t *buffer = malloc(buffer_size);
+                    uint8_t *buffer = ng_malloc(buffer_size);
                     ssize_t bytes = recv(s->socket, buffer, (size_t) buffer_size, 0);
                     if (bytes < 0) {
                         // Socket error
@@ -609,7 +609,7 @@ void check_tcp_socket(const struct arguments *args,
                             s->tcp.unconfirmed++;
                         }
                     }
-                    free(buffer);
+                    ng_free(buffer);
                 }
             }
         }
@@ -723,7 +723,7 @@ jboolean handle_tcp(const struct arguments *args,
                         packet, mss, ws, ntohs(tcphdr->window) << ws);
 
             // Register session
-            struct ng_session *s = malloc(sizeof(struct ng_session));
+            struct ng_session *s = ng_malloc(sizeof(struct ng_session));
             s->protocol = IPPROTO_TCP;
 
             s->tcp.time = time(NULL);
@@ -760,12 +760,12 @@ jboolean handle_tcp(const struct arguments *args,
 
             if (datalen) {
                 log_android(ANDROID_LOG_WARN, "%s SYN data", packet);
-                s->tcp.forward = malloc(sizeof(struct segment));
+                s->tcp.forward = ng_malloc(sizeof(struct segment));
                 s->tcp.forward->seq = s->tcp.remote_seq;
                 s->tcp.forward->len = datalen;
                 s->tcp.forward->sent = 0;
                 s->tcp.forward->psh = tcphdr->psh;
-                s->tcp.forward->data = malloc(datalen);
+                s->tcp.forward->data = ng_malloc(datalen);
                 memcpy(s->tcp.forward->data, data, datalen);
                 s->tcp.forward->next = NULL;
             }
@@ -774,7 +774,7 @@ jboolean handle_tcp(const struct arguments *args,
             s->socket = open_tcp_socket(args, &s->tcp, redirect);
             if (s->socket < 0) {
                 // Remote might retry
-                free(s);
+                ng_free(s);
                 return 0;
             }
 
@@ -995,12 +995,12 @@ void queue_tcp(const struct arguments *args,
             log_android(ANDROID_LOG_DEBUG, "%s queuing %u...%u",
                         session,
                         seq - cur->remote_start, seq + datalen - cur->remote_start);
-            struct segment *n = malloc(sizeof(struct segment));
+            struct segment *n = ng_malloc(sizeof(struct segment));
             n->seq = seq;
             n->len = datalen;
             n->sent = 0;
             n->psh = tcphdr->psh;
-            n->data = malloc(datalen);
+            n->data = ng_malloc(datalen);
             memcpy(n->data, data, datalen);
             n->next = s;
             if (p == NULL)
@@ -1017,18 +1017,18 @@ void queue_tcp(const struct arguments *args,
                             session,
                             s->seq - cur->remote_start, s->seq + s->len - cur->remote_start,
                             s->seq + datalen - cur->remote_start);
-                free(s->data);
+                ng_free(s->data);
                 s->len = datalen;
-                s->data = malloc(datalen);
+                s->data = ng_malloc(datalen);
                 memcpy(s->data, data, datalen);
             } else {
                 log_android(ANDROID_LOG_ERROR, "%s segment larger %u..%u < %u",
                             session,
                             s->seq - cur->remote_start, s->seq + s->len - cur->remote_start,
                             s->seq + datalen - cur->remote_start);
-                free(s->data);
+                ng_free(s->data);
                 s->len = datalen;
-                s->data = malloc(datalen);
+                s->data = ng_malloc(datalen);
                 memcpy(s->data, data, datalen);
             }
         }
@@ -1188,7 +1188,7 @@ ssize_t write_tcp(const struct arguments *args, const struct tcp_session *cur,
     uint8_t *options;
     if (cur->version == 4) {
         len = sizeof(struct iphdr) + sizeof(struct tcphdr) + optlen + datalen;
-        buffer = malloc(len);
+        buffer = ng_malloc(len);
         struct iphdr *ip4 = (struct iphdr *) buffer;
         tcp = (struct tcphdr *) (buffer + sizeof(struct iphdr));
         options = buffer + sizeof(struct iphdr) + sizeof(struct tcphdr);
@@ -1219,7 +1219,7 @@ ssize_t write_tcp(const struct arguments *args, const struct tcp_session *cur,
         csum = calc_checksum(0, (uint8_t *) &pseudo, sizeof(struct ippseudo));
     } else {
         len = sizeof(struct ip6_hdr) + sizeof(struct tcphdr) + optlen + datalen;
-        buffer = malloc(len);
+        buffer = ng_malloc(len);
         struct ip6_hdr *ip6 = (struct ip6_hdr *) buffer;
         tcp = (struct tcphdr *) (buffer + sizeof(struct ip6_hdr));
         options = buffer + sizeof(struct ip6_hdr) + sizeof(struct tcphdr);
@@ -1316,7 +1316,7 @@ ssize_t write_tcp(const struct arguments *args, const struct tcp_session *cur,
                     datalen,
                     errno, strerror((errno)));
 
-    free(buffer);
+    ng_free(buffer);
 
     if (res != len) {
         log_android(ANDROID_LOG_ERROR, "TCP write %d/%d", res, len);
diff --git a/app/src/main/jni/netguard/udp.c b/app/src/main/jni/netguard/udp.c
index c16603d7..d7ae7513 100644
--- a/app/src/main/jni/netguard/udp.c
+++ b/app/src/main/jni/netguard/udp.c
@@ -104,7 +104,7 @@ void check_udp_socket(const struct arguments *args, const struct epoll_event *ev
         if (ev->events & EPOLLIN) {
             s->udp.time = time(NULL);
 
-            uint8_t *buffer = malloc(s->udp.mss);
+            uint8_t *buffer = ng_malloc(s->udp.mss);
             ssize_t bytes = recv(s->socket, buffer, s->udp.mss, 0);
             if (bytes < 0) {
                 // Socket error
@@ -142,7 +142,7 @@ void check_udp_socket(const struct arguments *args, const struct epoll_event *ev
                         s->udp.state = UDP_FINISHING;
                 }
             }
-            free(buffer);
+            ng_free(buffer);
         }
     }
 }
@@ -196,7 +196,7 @@ void block_udp(const struct arguments *args,
                 source, ntohs(udphdr->source), dest, ntohs(udphdr->dest));
 
     // Register session
-    struct ng_session *s = malloc(sizeof(struct ng_session));
+    struct ng_session *s = ng_malloc(sizeof(struct ng_session));
     s->protocol = IPPROTO_UDP;
 
     s->udp.time = time(NULL);
@@ -267,7 +267,7 @@ jboolean handle_udp(const struct arguments *args,
                     source, ntohs(udphdr->source), dest, ntohs(udphdr->dest));
 
         // Register session
-        struct ng_session *s = malloc(sizeof(struct ng_session));
+        struct ng_session *s = ng_malloc(sizeof(struct ng_session));
         s->protocol = IPPROTO_UDP;
 
         s->udp.time = time(NULL);
@@ -300,7 +300,7 @@ jboolean handle_udp(const struct arguments *args,
         // Open UDP socket
         s->socket = open_udp_socket(args, &s->udp, redirect);
         if (s->socket < 0) {
-            free(s);
+            ng_free(s);
             return 0;
         }
 
@@ -447,7 +447,7 @@ ssize_t write_udp(const struct arguments *args, const struct udp_session *cur,
     // Build packet
     if (cur->version == 4) {
         len = sizeof(struct iphdr) + sizeof(struct udphdr) + datalen;
-        buffer = malloc(len);
+        buffer = ng_malloc(len);
         struct iphdr *ip4 = (struct iphdr *) buffer;
         udp = (struct udphdr *) (buffer + sizeof(struct iphdr));
         if (datalen)
@@ -477,7 +477,7 @@ ssize_t write_udp(const struct arguments *args, const struct udp_session *cur,
         csum = calc_checksum(0, (uint8_t *) &pseudo, sizeof(struct ippseudo));
     } else {
         len = sizeof(struct ip6_hdr) + sizeof(struct udphdr) + datalen;
-        buffer = malloc(len);
+        buffer = ng_malloc(len);
         struct ip6_hdr *ip6 = (struct ip6_hdr *) buffer;
         udp = (struct udphdr *) (buffer + sizeof(struct ip6_hdr));
         if (datalen)
@@ -538,7 +538,7 @@ ssize_t write_udp(const struct arguments *args, const struct udp_session *cur,
     } else
         log_android(ANDROID_LOG_WARN, "UDP write error %d: %s", errno, strerror(errno));
 
-    free(buffer);
+    ng_free(buffer);
 
     if (res != len) {
         log_android(ANDROID_LOG_ERROR, "write %d/%d", res, len);
diff --git a/app/src/main/jni/netguard/util.c b/app/src/main/jni/netguard/util.c
index 483856f8..b3eaecec 100644
--- a/app/src/main/jni/netguard/util.c
+++ b/app/src/main/jni/netguard/util.c
@@ -130,7 +130,7 @@ char *hex(const u_int8_t *data, const size_t len) {
     char hex_str[] = "0123456789ABCDEF";
 
     char *hexout;
-    hexout = (char *) malloc(len * 3 + 1); // TODO free
+    hexout = (char *) ng_malloc(len * 3 + 1); // TODO free
 
     for (size_t i = 0; i < len; i++) {
         hexout[i * 3 + 0] = hex_str[(data[i] >> 4) & 0x0F];