Can Someone Tell Me, How Does Hikvision's SADP Tool Work?

I wanted to understand it at protocol level. I wanted to understand it basic implementation and working. Also, how does the tool detect cameras in different subnet from the PC on which it is running?

I use it on a daily basis. You will need WinPcap installed in order for it to find all cameras on the network (Whether they are on the same subnet or not).

It uses a method to identify its own cameras. I do not know the science, but know that it always finds my cameras no matter what.

Use SADP v.3

...find all cameras on the network. (Whether they are on the same subnet or not).

Do you have to identify the possible subnet ranges first?

While I am no expert, these discovery tools talk on layer 2 of the network and MACs are used. IP doesn't matter at this level. They search for matching OUIs to identify specific manufacturers. OUI matches and it lists the device and reports it's IP address.

You can look up the OSI model for more info on network layers.