How do code coverage tools work?

Question

How do code coverage tools like NCover know what parts of the code were executed and what parts were not?

Answer 1

I know this is question is old but if you are still interested you can see an example of how such instrumentation is performed for .NET applications by looking at the open source project OpenCover.

OpenCover inserts instrumentation points at significant points in the code.

1. For code line coverage it uses the sequence points taken from a PDB file
2. For branch coverage it instruments COND_BRANCH instructions by instrumenting the jump target(s) and the next instruction after the branch instruction i.e. no jump.
3. For method instrumentation it instruments the first instruction of any method.

All of these rules are applied in CoverageInstrumentation.cpp after the appropriate points have been located using Mono.Cecil and passed to the profiler from the console host.

The source code to PartCover is also available (as indicated) but this is much harder to follow but it also uses sequence points from PDBs to determine where it instruments the code.