Patrick Horgan explains
the process of starting a program on Linux in great detail.
Well, __libc_start_main calls __libc_init_first,
who immediately uses secret inside information to find the
environment variables just after the terminating null of the
argument vector and then sets a global variable __environ
which __libc_start_main uses thereafter whenever it needs
it including when it calls main. After the envp
is established, then __libc_start_main uses the same trick
and surprise! Just past the terminating null at the end of the
envp array, there’s another vector, the ELF auxiliary
vector the loader uses to pass some information to the process. An
easy way to see what’s in there is to set the environment variable
LD_SHOW_AUXV=1 before running the program.