My understanding is that .NET (C#) code compiles to Common Intermediate Language (CIL) code, which then (usually) gets Just-In-Time compiled to native machine code at run-time on the deployment machine in conjunction with the common language runtime.
My question is, how does the actual work that gets done on the deployment machine at runtime relate with standard native WinAPI calls, assuming we're talking about a Win NT deployment machine? If I were to open a .NET file in OllyDbg for example, am I going to still see system calls to ntdll and or Kernel32 showing up, coming from the JITC'd code? .NET is also occasionally said to be "running in a virtual machine" similar to Java Bytecode. But still, at the end of the day, must the program still leave a signature of system calls in memory, even though the binary itself may not be able to be viewed properly by IDA?
I've been doing research into this and for example, I found this article on CryptGenRandom which is used by .NET's RNGCryptoServiceProvider . However, I've never heard of anyone using a native debugger to try to view these calls from JIT'd/interpreted/VM code.