Auxiliary Vector

Hadfi Abdel Moumene
3 min readDec 15, 2020

There are many mechanism for communicating information between kernel & user space application . one of this mechanism is Auxiliary Vector .

Just what is the auxiliary vector?

In essence auxiliary vector is a list of key-value pairs that the ELF binary loader constructs when a new executable image is loaded into a process [Source] .

After construction of the list , ELF binary loader puts auxiliary vectors on the process stack (bottom of the stack) [Source].

So after initialization , a process stack looks something like this :

if we dive deep we gonna find that the auxiliary vector is an array of the following structure :

  • a_un : defines the entry value .
  • a_type : defines the entry type and contain one of the following values :

the whole list is defined in [include/uapi/linux/auxvec.h] & [include/uapi/asm/auxvec.h] .

Reading the auxiliary vector

at the shell level , we can discover the auxiliary vector that was supplied to an executable by setting LD_SHOW_AUXV environment variable when launching an application :

also the auxiliary vector of each process on the system is accessible via a corresponding /proc/PID/auxv file .

also we can access these parameters inside the program by using this function

#include <stdio.h>
#include <sys/auxv.h>
int main() {
unsigned long long entryAddr = getauxval(AT_ENTRY);
printf("0x%llx\n",entryAddr);
}

--

--

Hadfi Abdel Moumene

linux kernel developer interested in reverse engineering & malware analysis