I was wondering how the Xprivacy app worked exactly. Does it do something with native Android code? With Java? Does it put itself between the data and any application that requests them, or only if the application has a restriction active for the relevant permission in Xprivacy?
XPrivacy is not a stand-alone application. It's a module of the Xposed framework, and thus utilizes the latter to achieve its goals. So if the Xprivacy dev "reports in", he might just say: "Waiting for the Xposed team to show up"...
Oh, if you don't wanna wait: head straight to the Xposed thread at XDA for all the details. The intro over there states:
I extended the
/system/bin/app_processexecutable to load a JAR file on startup. The classes of this file will sit in every process (including the one for system services) and can act with their powers. And even more: I have implemented something that allows developers to replace any method in any class (may it be in the framework, systemui or a custom app). This makes Xposed very powerful. You can change parameters for the method call, modify the return value or skip the call to the method completely - it's all up to you! Also replacing or adding resources is easy.
So in short and simplified words: Xposed replaces some system resources to "expose" the system API, so other apps (acting as Xposed modules) can use it. Amongst those other apps is – tam-tam-tam-tam-tam – Xprivacy.