Reverse code engineering: an in-depth analysis of the Bagle virus

Abstract

This paper is the result of work done in the field of reverse code engineering and how it could be applied to better detecting viruses and worms. The goal of this paper is to try to answer the following two questions: How do you reverse engineer a virus and can reverse engineering a virus lead to better ways of detecting, preventing, and recovering from a virus and its future variants? In addition, the paper describes the Bagle virus, the resources and environment used for analysis, the approach and techniques used to completely reverse engineer the Bagle virus, and some of the analysis problems encountered and their solutions. It also presents some best practices to use while reverse code engineering.