I'm trying to understand how shellcode works.
I wrote a simple program in C#, then I used Donut to create the shellcode from that exe in base64 format. Then, I wrote again another program to convert the base64 shellcode in a sequence of bytes, in order to reproduce the original exe.
I noticed a difference: ILSpy is able to open the first one, but no the latter since it says "pe file does not contain any managed metadata", indicating that is not a C# program. Moreover, there is a small difference in the size so definitively the checksum is different.
Could someone explain what happened? Is there a way to decompile this program?