CoreClrImageBase

trick.cs

namespace ConsoleApp1
{
    internal static class Program
    {
        private static unsafe void Main(string[] args)
        {
            var tp = new ThreadPrivateAccessor {Thread = Thread.CurrentThread};
            var currentThreadHandle = (void**)tp.ThreadExposer._DONT_USE_InternalThread;
            var someProcFromCoreClr = *currentThreadHandle;
            var coreClrImageBase = (byte*)someProcFromCoreClr - 0x3ec4c0;
        }
    }
    
    public sealed class ThreadExposer
    {
        internal ExecutionContext? _executionContext;
        internal SynchronizationContext? _synchronizationContext;
        private string? _name;
        private Delegate? _delegate;
        private object? _threadStartArg;
        public/*Sic!*/ IntPtr _DONT_USE_InternalThread; 
    }

    [StructLayout(LayoutKind.Explicit)]
    public struct ThreadPrivateAccessor
    {
        [FieldOffset(0)]
        public Thread Thread;
        [FieldOffset(0)]
        public ThreadExposer ThreadExposer;
    }
 }