using System;

using System.Runtime.InteropServices;

​

namespace Makeref_Safe

{

    class Program

    {

        static void Main(string[] args)

        {

            int[] array = new int[20];

​

            array[1] = (int)typeof(Klass).TypeHandle.Value;

            array[2] = 123;

​

            GCHandle arrayHandle = GCHandle.Alloc(array);

            var arrayAddress = Marshal.ReadIntPtr(GCHandle.ToIntPtr(arrayHandle));

​

            Holder<Klass> holder = new Holder<Klass>();

            GCHandle holderHandle = GCHandle.Alloc(holder);

            var holderAddress = Marshal.ReadIntPtr(GCHandle.ToIntPtr(holderHandle));

            Marshal.WriteIntPtr(holderAddress, 4, arrayAddress + 3 * 4); // Skip Method Handle, array size, first integer for sync block, assumes x86

​

            Console.WriteLine(holder.reference.GetType());

            Console.WriteLine(holder.reference.Field);

            array[2] = 456;

            Console.WriteLine(holder.reference.Field);

        }

    }

​

    class Holder<T>

    {

        public T reference;

    }

​

    class Klass

    {

        public int Field;

    }

}

​