There are different techniques out there for mocking.
Some mocking libaries like Moq and RhinoMocks use Castle Dynamic proxies. Essentially, they use reflection and runtime code generation (CodeDom) to dynamically generate classes that either implement an interface being mocked, or derive from a non-sealed class that's being mocked.
TypeMock is a bit different - it uses the Profiler APIs to intercept and redirect calls to any method on any type. This makes it capable of mocking sealed types, system classes, and even intercept and divert calls to non-virtual methods of concrete types.
UPDATE: From the TypeMock website:
Typemock Isolator uses an Aspect-
Oriented programming design that
creates a mock aspect. Internally, it
uses the .NET framework profiler API
to monitor an application's execution.
When a method is called, the CLR
notifies Typemock Isolator. The
framework can then return mocked
values and override the original code
completely.