Question

If I use getenv() to disable some verifications of my program (for instance license checking) will a hacker be able to discover easily the concerned environment variable (using strace or other ?)

Exemple of code:

if (! getenv("my_secret_env_variable")) checkLicense();

(If, on the other hand, I checked the presence of a specific file, the hacker would see it immediately with strace)

Answer 1

the hacker would see it immediately with strace – maybe you should take a look at ltrace as well?

While you might not be able to hide the variable name, why not require a value? In particular you could use an integer for a valid value (atoi) since they are a lot harder to spot in code, or even a combination of ints and single chars. However remember that the environment block is an easy part of memory to find, especially in a core dump.