Most of the open-source mocking frameworks use Castle Windsor's Dynamic Proxy to automatically generate a type at runtime, that can be programmed with expected behavior. This is why most of those frameworks require having an interface or an abstract class - they are unable to mock anything that is not a virtual method.
There exist other (commercial) mocking frameworks that indeed can mock static and regular (sealed) classes, including CLR types, which are based on the unmanaged CLR Profiler API. Basically, the mocking framework acts as a profiler, and is able to modify the MSIL instructions in memory just before the JIT compilation. This is how it's able to replace the body of any method with predefined values. Some of those frameworks are free* (Microsoft Fakes, part of Visual Studio 2012 Ultimate), others are paid products, such as Typemock.