The code that generates the sssion identifier is here - but it's C, since it implements PHP itself.
Basically, it uses a cryptographic hash function and enters the remote IP address, current time and some other things.
The hash function to use and optionally the source of additional entropy can be configured in php.ini .