This isn't really a complete answer but there are lots of GPU debugging tools (pix, etc..) that'll catch the DirectX calls with their arguments, intercepting the raw shader code (if it wasn't already available) and everything relating to constant buffer layout, vertex layout, etc... so I would assume they reverse-engineer and study it this way.
If the mod can be fully self-contained within the shader, it's a lot easier, but otherwise they could be injecting new additional code in the executable (kind of like Fraps does to capture DirectX frames) to enable additional behaviour and special effects. This is also possible if the source can be decompiled and made sense of to some extent (like Minecraft, the code is obfuscated but you can still kind of understand where you need to add your modding code, and then recompile the jar file).