How do microsoft fakes' shims actually work internally?

Question

So I am interested in the way that it is implemented. Basically: How can I re-implement the same thing myself? ... which I am not intending to do. Just understand.

The fundamental question is: How is it possible to (?) intercept class instantiation at all? And how can it be replaced in one case with one implementation and in another occurence with it's original or an even different implementation?

How is it even possible to intercept static methods or sealed classes.

This is all about shims/moles not so much about stubs.

Answer 1

This is done by changing the Common Intermediate Language (IL) code that is emitted by the compiler. You can do pre-packaged IL modification using the Fody library. Fody internally uses the mono.cecil library for the low level IL manipulation. The IL generated by the compiler is modified and saved to disk as an assembly.

I have found this reference publication on Moles [pdf file]. Section 4 explains the mechanism of the code instrumentation.