It essentially works by sending screenshots on the fly. (The "real time" here is something wrong, because there is no clear deadline.) It only tries to optimize by sending areas of the screen that have been changed, and some forks of the VNC code line use a mirror driver to receive a notification when the display areas are recorded, in while others use window message hooks to detect redraw requests.
source
share