Weird Ways to Run Unmanaged Code in .NET

This post analyses .NET CLR internals to demonstrate multiple offensive techniques for executing unmanaged code from managed .NET processes. It covers delegate-based invocation (Marshal.GetDelegateForFunctionPointer), stealing existing framework P/Invokes, locating and overwriting JIT trampolines and native code slots to trigger arbitrary native payloads (including Cobalt Strike), and abusing internal FCall/QCall “gadgets” to read/write memory, with annotated C# PoC code and WinDBG inspection.