Decompiling shellcode

Question

I'm trying to understand how shellcode works.

I wrote a simple program in C#, then I used Donut to create the shellcode from that exe in base64 format. Then, I wrote again another program to convert the base64 shellcode in a sequence of bytes, in order to reproduce the original exe.

I noticed a difference: ILSpy is able to open the first one, but no the latter since it says "pe file does not contain any managed metadata", indicating that is not a C# program. Moreover, there is a small difference in the size so definitively the checksum is different.

Could someone explain what happened? Is there a way to decompile this program?

Answer 1

C# (and other .Net languages) are compiled into Common Intermediated Language bytecode which is translated into native code "Just in Time" by the Common Language Runtime. This is similar to how java works. Donut converts the intermediate bytecode generated by your C# compiler into shellcode (i.e. native code which the cpu can process directly).*

ILSpy reverts Intermediate Language bytecode back into C#. It isn't designed to, and therefore cannot, convert shellcode back into C# code. Your second executable contained shellcode from Donut so ILSpy didn't find any managed metadata in it and couldn't decompile it. If you want further help for decompiling the shellcode, try asking at https://reverseengineering.stackexchange.com

---

_{*For further information on this, read Donut's own explanation}