For dynamically linked GCC/glibc programs on Linux, main() is not the process entry point. The kernel starts the loader. It maps libc and applies relocations. _start passes main to glibc, which initializes the process and calls it. I traced the path from source.c to main().

The jump from the kernel entry point to _start, then through libc before main(), is one of those details that makes the runtime feel much less magical.

Most people think a C program starts at main(). It doesn’t. The kernel starts the loader first.

Almost. The kernel does not start _start. It maps the ELF, reads PT_INTERP, jumps into Relocations finish there. Only then does control reach _start, which passes &main into _libc_start_main. main is a callback. If your mental model starts at main, you already skipped the ABI.

insightful

@tweem 110000 views

Never fade Tetsuo

It's not the entry point for statically linked ones either. It's just the start of the C platform.

@VOLDEMORT2X 😭👈🏻

cool

I tied for the biggest bug bounty at my last employer with an LD_PRELOAD exploit. Any support tech could have gotten root