The images are actually embedded into the emulator (more than likely). When the page gets generated the packet sends out the image names.
You must be registered for see images attach
.
Here is a screenshot from my emulator base. As you can see in the catalogpagecomposer.cs file if the template is frontpage4 we are sending out the string titles (Which I have in my emulator config files, yours will probably also be hard coded) and the image is catalogue/section0.png