Hi Jason, "module_load" will be called once for each file, when the file is about to be scanned, no matter how many rules you are using. The "module_load" function allows modules to initialize themselves and read any data they need from the file being scanned. Once all modules are initialized, yara proceeds with the scanning. Modules are not aware of how many rules are using them.
Could you explain a little more what do you want to do? Regards, Víctor On Fri, Jan 22, 2016 at 5:35 PM, Jason Keirstead <jason.keirst...@gmail.com> wrote: > Hi, I am working on a custom YARA module and I was wondering if someone > with more knowledge of YARA's internals could give quickly me some pointers > so I don't have to wade through the source code. I have read all of the > documentation on writing a new module but I still have some unanswered > questions around module lifecycle. > > What is the lifecycle of a YARA module used in many different rules that > cross-reference? The documentation says "module_load" is called once for > each "scanned file". Say I have a module that is used in RuleA, and then I > have RuleB that references RuleA and also uses my module. Will module_load > be called once for each rule? > > If it does not - is there some other way I can initialize data that is > specific to each rule? > > The gist of this is I want my module to be able to have some > rule-use-specific data tracking. > > > -- > You received this message because you are subscribed to the Google Groups > "YARA" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to yara-project+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/d/optout. > -- You received this message because you are subscribed to the Google Groups "YARA" group. To unsubscribe from this group and stop receiving emails from it, send an email to yara-project+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
