I did a bit of a dive on it a while back - it works via peertalk (https://github.com/rsms/peertalk), which in turn works by connecting to local sockets provided by `usbmuxd`.