Add support for piping script body to Invoke-Expression instead of passing as first argument

[nitecoder]

Hello TheWhiteNinja,
Thanks for the great project!

I'm trying to use this and finding that some common malware samples aren't being handled. Specifically things like this:

(New-Object System.IO.StreamReader 
   @(
     (New-Object System.IO.Compression.DeflateStream 
       @([System.IO.MemoryStream][Convert]::FromBase64String("...base64-string..."), 
         [IO.Compression.CompressionMode]::Decompress
        )
     ),
     [System.Text.Encoding]::ASCII
    )
).ReadToEnd() | Invoke-Expression;

I've been thinking about how to add support for this. After digging a bit, I think there are two problems:

• there is support for Invoke-Expression but it is currently only expecting script body in the first argument
• there is no support for applying base64 decoding and decompressions statically

I'm going to try to add these in some way. But if you have any hints or thoughts about how this would best fit into the current code, I would very much appreciate a hint!

For the pipeline input into Invoke-Expression I think the easiest way would be to add support in opt_invoke_expression to match parent nodes of the AST to see if it's a member of a pipeline, and if the preceding element is a string constant. Actually, this could just be a separate optimization to rewrite this to Invoke-Expression("...the-string-constant...") | ... <the rest of pipeline>.
Or maybe it would be best as a pipeline optimization? Any pipeline of the form string-constant | command rewrites to command string-constant?

I haven't yet decided what to do with the base64+deflate -> string constant step.