RASP takes a naive application and enables it to identify attacks and block them. There are a number of different approaches including filters, sandboxes, and full instrumentation. Here's a good independent article on RASP describing the use cases and approaches: https://securosis.com/blog/understanding-and-selecting-rasp-technology-overview.
Let's look at a simple SQL injection example. A naive application simply has no defense and gets exploited. An application that uses PreparedStatements is safe against injection, but has no idea whether it is being attacked or not. Let's see how this works with RASP. I'm describing Contrast's instrumentation approach here.
First, the RASP is installed into the application. In this case, simply adding the RASP agent to the environment is enough. When the code loads, the RASP uses dynamic binary instrumentation to add new security sensors and analysis capability to the application. This process is very similar to how NewRelic or AppDynamics work to instrument an application for performance.
When the attack arrives at the application, RASP uses gathers data about the request, the user, the session, and any other contextual information. The attacker's request data is tracked through the application. If it looks like an attack, but never reaches a SQL query, it gets reported as a probe. This is a major difference from what a WAF can do, as WAFs are not able to see what happens inside the application and must overblock.
If the attack actually reaches a SQL query and modifies the meaning of that query, only then does RASP block the attack. This is essentially enforcing the definition of SQL Injection, as only attacks that successfully modify the meaning of SQL queries are blocked. This is why RASP implementation can be deployed without much configuration or training.
Ultimately, the user gets visibility into who is attacking their applications, where the attacks are coming from, the techniques being used, the exact line of code that is being targeted, and the full SQL query containing the attack. The number of viable attacks is only a tiny fraction of the overall probes that never hit a matching vulnerability. So the results are quite different than what a WAF can provide.
The process is roughly the same for other vulnerabilities. Although, RASP may add specific protections for known vulnerabilities in libraries and components. RASP may also add security logging or other security features to applications.