Probably uses the screen capture API like Eric said, and also the “input” command available on the adb shell.