Memory Slice (.msl) support: io/bin/debug plugins + dgm + reverse-exec

[ricardojrdez]

Summary

Adds support for Memory Slice (.msl) process memory dumps — the format
produced by memslicer — so a static
snapshot can be analyzed and emulated/stepped in radare2, plus a producer to
write a slice from a live debug session. Three commits (plugins, a small core
fix, the dump command).

Commits

1. io,bin,debug: add Memory Slice (.msl) plugins.

   • io.msl — exposes the captured virtual address space (msl://), honoring
     the three-state page map; decodes lz4 regions in memory (zstd isn't
     decodable by r2 — warns clearly). Doubles as a debug IO so a slice can be
     opened in debug mode without spawning a process.
   • bin.msl — parses a slice as CORE (arch/bits/OS, entry0 = captured PC,
     one section/map per contiguous run of captured pages).
   • debug.msl — emulated backend: sets arch from the header, seeds the full
     register file from the Thread Context, and routes ds/dso/dc/dr/dm
     to ESIL.
   • Usage: r2 dump.msl (analysis) or r2 -D msl -d msl://dump.msl (debug).
     See doc/msl.md.

2. core/debug: route dc to ESIL when cfg.debug is unset.
   ds already dispatches to aes for emulated targets; dc always went
   through r_debug_continue (arena swap + trace + recoil), which assumes a
   live ptrace process and corrupts state on an emulated target (msl / esil).
   Mirror the ds behaviour: continue via aec. General fix, also helps the
   stock esil backend.

3. debug: dgm writes a Memory Slice of the debuggee.
   Producer side: dgm [file] serializes the live session (header, Process
   Identity, Thread Context with the current registers, one Memory Region per
   map). Reads maps in 1 MiB chunks, skips unreadable maps, and by default skips
   very large maps (e.g. the macOS dyld shared cache) — dgma for everything.
   Integrity chain uses SHA-256 (HashAlgo 0x01) since r2 has no BLAKE3.

4. debug: reverse execution (dsb/aesb).
   Enable ESIL step-back recording so execution can be stepped backwards
   through an emulated slice, reverting PC and register/memory state
   (time-travel debugging of a static snapshot).

Notes

• New plugins are registered for both the meson and acr/make builds.
• MVP scope: uncompressed or lz4, unencrypted slices.

[trufae]

i think that adds too much complexity for such an niche feature and i think it will be better to ship it in radare2-extras or as an external repository until lthe code is mature enough to consider it to ship it directly in core. Can you please make this pr against the radare2-extras repo instead? we can have an r2pm pkg later to install all those plugins in 1 command. if you want to ship that in an r2 build we can add a 'r2plugin' directory to expose the plugin for make and meson. but for now i think its better to maintain this project outside the core and maybe update the readme referencing the plugin for visibility reasons.

[trufae]

i can do this moving into radare2-extras for you if you want

[ricardojrdez]

Thanks @trufae, makes sense; done. I moved the whole thing into radare2-extras as a self-contained msl/ bundle (io/bin/debug plugins + a core plugin for the dgm/dgma producer), buildable standalone via pkg-config and r2pm-friendly:

radareorg/radare2-extras#394

The only piece I kept for core is a generic one unrelated to the format: routing dc to ESIL when cfg.debug is unset, so it works on any emulated backend (mirrors how ds already dispatches to aes). Sent as its own small PR, see #26144

I'll close this one in favor of those. Happy to add an r2pm recipe and reference it from the README whenever you think it's ready :). Thanks for the pointer!