So I am reversing an ELF‌ binary, now from my knowledge in C the main function has two argument, argc and argv

but some linux binaries that i am reversing have 3 when i decompile them! one int and the other two are char**, i assume the second is the argv but what is the last one?

one example is this binary for a CTF‌:‌



1 Answer 1


The third one is an array to environment variables that this program has access to. If you read the documentation of execve it reads as follows:

The argument vector and environment can be accessed by the called program's main function, when it is defined as:

int main(int argc, char *argv[], char *envp[])

Note, however, that the use of a third argument to the main function is not specified in POSIX.1; according to POSIX.1, the environment should be accessed via the external variable environ(7).

  • So this third argument thing is used in linux systems and not in widnows, and is added by the compiler correct?
    – Mery Ted
    Nov 12, 2019 at 6:07
  • That would be my understanding too. Nov 12, 2019 at 6:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.