How do code coverage tools like NCover know what parts of the code were executed and what parts were not?
Here's a technical paper on How to Implement test coverage tools for arbitrary languages.
My company builds a family of test coverage tools for Java, C#, C++, PHP, COBOL, PLSQL, ... based on this principle.