By hooking into the execution of functions

By reading the memory usage

By scanning compiled code (for used vars)

By remembering locations of variables