Hi, I am working on a custom YARA module and I was wondering if someone with more knowledge of YARA's internals could give quickly me some pointers so I don't have to wade through the source code. I have read all of the documentation on writing a new module but I still have some unanswered questions around module lifecycle.
What is the lifecycle of a YARA module used in many different rules that cross-reference? The documentation says "module_load" is called once for each "scanned file". Say I have a module that is used in RuleA, and then I have RuleB that references RuleA and also uses my module. Will module_load be called once for each rule? If it does not - is there some other way I can initialize data that is specific to each rule? The gist of this is I want my module to be able to have some rule-use-specific data tracking. -- You received this message because you are subscribed to the Google Groups "YARA" group. To unsubscribe from this group and stop receiving emails from it, send an email to yara-project+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
