How does a cable tone-and-probe kit work?
The tone generator injects a signal onto the cable to be traced. Typically it's a Square wave (with high harmonic content), or a warbling tone.

Here's an example:



The probe tool is usually called an Inductive Amplifier, but in reality it works by capacitive coupling from the tone injected onto the wire.

There's a very informative Google group discussion on this, where the probe is described as:


  The original 'banana' probe is simply a LM386 driving a mini 1" (25 mm)
  to 1.3" (30 mm) speaker.  The input has an MPF102 JFET as a source
  follower, with a 4.7k source load resistor and a 10 meg from gate to
  ground (&amp; collector to +9V).  A 47 pf cap in parallel with the 10 M to
  rolloff highs, and a 1 Meg in series between the gate and probe tip.
  The source load resistor is coupled to the input of 386 thru a .1 uF
  ceramic cap.  A push button momentary contact switch and 9V battery
  complete the circuit.


This site describes one guys attempt at building one.