Locating argc, argv, and envp on the stack is done by the runtime [0].

[0] https://github.com/lpsantil/rt0/blob/master/src/lib/00_start...