How does the application Xprivacy give fake private data to applications?
XPrivacy is not a stand-alone application. It's a module of the Xposed framework, and thus utilizes the latter to achieve its goals. So if the Xprivacy dev "reports in", he might just say: "Waiting for the Xposed team to show up"...

Oh, if you don't wanna wait: head straight to the Xposed thread at XDA for all the details. The intro over there states:


  I extended the /system/bin/app_process executable to load a JAR file on startup. The classes of this file will sit in every process (including the one for system services) and can act with their powers. And even more: I have implemented something that allows developers to replace any method in any class (may it be in the framework, systemui or a custom app). This makes Xposed very powerful. You can change parameters for the method call, modify the return value or skip the call to the method completely - it's all up to you! Also replacing or adding resources is easy.


So in short and simplified words: Xposed replaces some system resources to "expose" the system API, so other apps (acting as Xposed modules) can use it. Amongst those other apps is – tam-tam-tam-tam-tam – Xprivacy.