I'm using Bullseye code coverage tool. It's great. I'm interested in knowing it's internal functioning. How does it actually work?
This is a tool-agnostic question. All of them work the same way: they instrument the code of your system. Each time a line or branch of your code is visited at runtime, the tool caches this information. Afterall, the number of visited lines (or branches) is divided by the total number of lines (or branches). This is done in the scope of a single class/file, package, packages subtrees and whole application.
The code instrumentation can be, however, tool- and language-specific.
Here you will find more info, links and research papers how to implement code coverage tool yourself and how instrumentation in example tools is done.