Looks like they are the "Locking Railrider 3" tower, and one of the many "Landing Pad" bottom mount variants. If you pull that cover just under the bar away from the tower, you can actually slide the bottom section off and you will see the tops of the bolts that hold the Landing Pad to the tracks when mounted.
Basically, the way these work is that you slide the bottom portion(Landing Pad) into one of the track systems,(usually Thule or Yakima tracks are interchangeable) then get the Landing Pad positioned where you want it and then tighten it down to the track. Next you slide the tower onto the Landing pad and flip the latch up and that locks the tower to the Landing Pad.
Here is a video of the process. He is using slightly different hardware, but the idea is the same.
Let me know if you need more clarification.