Skip to content

Instantly share code, notes, and snippets.

@matiaspl

matiaspl/mars400s.md

Last active November 5, 2023 20:57
Show Gist options
  • Star 3 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save matiaspl/f4fdecd4f448ab1d6e28b838b5dc4340 to your computer and use it in GitHub Desktop.
Save matiaspl/f4fdecd4f448ab1d6e28b838b5dc4340 to your computer and use it in GitHub Desktop.
Download ZIP
Hollyland Mars 400S Pro hacking
Raw
mars400s.md

Architecture:

The TX side act as an access point for both the hardware reciever and the software clients. The video goes over regular 5G AC wifi link.

A simple IP scan shows the following:

192.168.218.10        6e-02-ab-96-f8-b2     dynamic  1 ms (unknown)
192.168.218.100       6c-4d-51-01-fe-74     dynamic  1 ms (Shenzhen Ceres Technology Co., Ltd.)
192.168.218.200       6c-4d-51-02-16-a1     dynamic  2 ms (Shenzhen Ceres Technology Co., Ltd.)
192.168.218.202       6c-4d-51-02-16-a1     dynamic  2 ms (Shenzhen Ceres Technology Co., Ltd.)
192.168.218.203                                      50 ms
192.168.218.255       ff-ff-ff-ff-ff-ff     static

Addresses 1-199 seem to be reserved for the local TX side whereas 200-254 are used by the RX side.
DHCP address range start at either 202 or 203

RTSP stream

rtsp://192.168.218.202:5554

The stream is H.264 ~8Mbit in balanced mode.

Telnet

192.168.218.10 and 100 - password yet unknown

Open ports

TX

23
5554
11114
60007
60008

RX

5554

TBC...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment