Little Stream Detector - A New Native Bitstream Analyzer

[eco-by-different]

Hi,

I have been working on a small portable Windows tool called Little Stream Detector (LSD).

The goal is to provide detailed information about encoded video streams, including frame-level QP/DRF statistics, GOP structure, frame types, bitrate profiles, and stream metadata.

Users familiar with AVInaptic may recognize the general direction, but LSD is an independent implementation. It performs native container and bitstream analysis and does not rely on FFmpeg, FFprobe, or MediaInfo.

Currently supported video codecs include AVC/H.264, HEVC/H.265, VP9, AV1, and XviD, with support for Matroska/WebM, MP4/MOV, and AVI containers.

Version 3.0 also introduces a simple Current A / Reference B comparison workflow for completed analyses, as well as interactive mouse-hover tooltips on the bitrate graph.

https://github.com/eco-by-different/Little-Stream-Detector/raw/main/lsd-gui.png

GitHub:
https://github.com/eco-by-different/Little-Stream-Detector

SourceForge:
https://sourceforge.net/projects/little-stream-detector/

Feedback, bug reports, and unusual test samples are always welcome.

[Z2697]

Good acronym :)

[kempodragon]

Gotta love double entendre!!

[DJ Bobo]

Windows Defender says the file has a virus?
Trojan:Win32/Wacatac.B!ml
I see there is a note on Github about it, but I think that is not enough.
I think it is better to find a solution so that it does not give a (false?) positive.

[eco-by-different]

Windows Defender says the file has a virus?

I see there is a note on Github about it, but I think that is not enough.
I think it is better to find a solution so that it does not give a (false?) positive.


To be fair, I understand why some AV products are suspicious.

LSD is a small hobby project distributed as a portable standalone executable generated from scripts and bundled resources. From a modern reputation-based antivirus perspective, that is almost a textbook example of something that deserves additional scrutiny.

That does not mean the application is malicious. It simply means the packaging approach, low prevalence, lack of code signing, and limited reputation can lead to false-positive detections.

For that reason, the full source code is publicly available and can be independently reviewed. Anyone who prefers maximum transparency can inspect the scripts and build or run the project directly from source.

In other words, the warning is understandable, but the project itself is completely open for verification.

[DJ Bobo]

It is not just "suspicious", Windows Defender gives a clear name for the virus, which is described HERE (https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Trojan%3AWin32%2FWacatac.B!ml)

[eco-by-different]

That's true, Defender reports a specific malware classification rather than simply marking the file as suspicious.

However, that classification appears to be a false positive in this case. I have been able to reproduce the detection myself on some builds.

The project is fully open source, and the complete source code is available for inspection and independent builds. The detection seems to be related to the packaging and distribution characteristics of the standalone executable rather than to the functionality of the application itself.

I certainly agree that the ideal solution would be to eliminate the detection entirely. Unfortunately that is not always easy for small unsigned hobby projects using compact portable executable packaging.

For anyone who wishes to verify the application independently, the source code remains the authoritative reference.

[Columbo]

I agree with eco-by-different. We've had identical issues with new DG tools. We reported some of them but we don't know if that did the trick or something else, like a threshold for usage was crossed. Even our first mod of eac3to triggered it. If the source is open and the author is transparent, I say give the benefit of the doubt.

Thank you eco-by-different for your work!

[Z2697]

You know, a powershell script with embedded C# code surely is very SUS
The open source won't help much here since the code is, um, condensed... (maybe some LLM will help but I don't use them)

[Cmptr]

I was actually going to make one of these using c++. You beat me to it.

[Cmptr]

You know, a powershell script with embedded C# code surely is very SUS
The open source won't help much here since the code is, um, condensed... (maybe some LLM will help but I don't use them)

Damn... It really is condensed....

[Cmptr]

Ive got it formatted if anyone is interested.

[eco-by-different]

A small usability improvement has been added to the QP/DRF distribution view.

You can now click the header row to toggle the A/B values between percentages and actual frame counts (% / pcs).

The attached screenshot shows both modes.

https://github.com/eco-by-different/Little-Stream-Detector/raw/main/01.png

If you have already downloaded version 3.0, please download it again to get the updated build.

[eco-by-different]

Added native VVC/H.266 analysis using a two-pass Collect / Resolve / Validate / Publish processing model.
Added native VVC vvcC, SPS, PPS, Picture Header, Slice Header, and reference-picture-list traversal.
Added native VVC I/P/B frame accounting and frame-level SliceQPY distribution with complete-picture validation.

If you have already downloaded version 3.0, please download it again to get the updated build.

[eco-by-different]

Added an optional Relative Q view for A/B comparisons.
When A and B use incompatible native quantizer metrics, such as AV1 Base Q Index and VVC SliceQPY, both distributions can now be mapped to separate codec-local 0–100% scales.

This provides an approximate comparison of distribution shape and relative quantization pressure. It does not represent equivalent visual quality or a direct conversion between codec metrics. Native Q values remain unchanged and available as before.

If you have already downloaded version 3.0, please download it again to get the updated build.

[eco-by-different]

A small update regarding the latest build

Available versions

- LSD.ps1
- LSD.exe
- LSD_mini.exe

There are currently three ways to use the tool:

PowerShell script

The original standalone PowerShell script. Its contents can be reviewed before execution, and it does not contain an executable wrapper.

IExpress package

The same PowerShell script packaged as an EXE using Microsoft IExpress. This version does not use MiniBuilder or the custom launcher. It currently produces the fewest antivirus detections in our testing, but uses the default IExpress icon.

Mini EXE

A compact executable of approximately 90 KB, created with MiniBuilder and our custom launcher. This version provides a custom EXE experience and includes our application icon, but it may trigger more heuristic antivirus detections.

All three versions perform the same basic task. The only differences are in packaging, appearance, and antivirus compatibility.

For maximum transparency, use the standalone PowerShell script. For convenient execution with fewer potential false positives, use the IExpress version. Choose the Mini EXE if you prefer the compact custom launcher and custom application appearance.