Weird Ways to Run Unmanaged Code in .NET

Structure Overview

The offset is how far an item is from the base location of the structure
So the first item would have a 0 offset, since it is the first item.
- Lets say the first item is a uint, which is 4 bytes in size.
- The second item of the structure would be 4 bytes in its offset, because it starts after the first item and the first item is 4 bytes.

Method Table

Source Code https://github.com/dotnet/runtime/blob/main/src/coreclr/vm/methodtable.h

Byte Offset	Data size (bytes)	Data Type	Property Name	Description
0	0x0	4	uint	m_dwFlags
4	0x4	4	uint	m_BaseSize
8	0x8	2	ushort	m_wFlags2
10	0x0a	2	ushort	m_wToken
12	0x0c	2	ushort	m_wNumVirtuals
14	0x0e	2	ushort	m_wNumInterfaces
16	0x10	8	IntPtr	m_pParentMethodTable
24	0x18	8	IntPtr	m_pLoaderModule
32	0x20	8	IntPtr	m_pWriteableData
40	0x28	8	IntPtr	m_pEEClass
48	0x30	8	IntPtr	m_pPerInstInfo
56	0x38	8	IntPtr	m_pInterfaceMap

Overall size: 64 bytes

EEClass

Documentation, line 1800 https://blog.weghos.com/coreclr/CoreCLR/vm/class.h.html

Byte Offset	Data size (bytes)	Data Type	Property name	Description
0	0x0	8	IntPtr	m_pGuidInfo
8	0x8	8	IntPtr	m_rpOptionalFields
16	0x10	8	IntPtr	m_pMethodTable
24	0x18	8	IntPtr	m_pFieldDescList
32	0x20	8	IntPtr	m_pChunks

Overall size: 40 bytes

MethodDescChunk

Byte Offset	Data size (bytes)	Data Type	Property Name	Description
0	0x0	8	IntPtr	m_methodTable
8	0x8	8	IntPtr	m_next
16	0x10	1	byte	m_size
17	0x11	1	byte	m_count
18	0x12	1	byte	m_flagsAndTokenRange

Overall size: 19 bytes

MethodDesc

Byte Offset	Data size (bytes)	Data Type	Property Name	Description
0	0x0	2	ushort	m_wFlags3AndTokenRemainder
2	0x2	1	byte	m_chunkIndex
3	0x3	1	byte	m_bFlags2
4	0x4	2	ushort	m_wSlotNumber
6	0x6	2	ushort	m_wFlags
8	0x8	8	IntPtr	TempEntry

Overall size: 16 bytes