By hooking into the execution of functions By reading the memory usage By scanning compiled code (for used vars) By remembering locations of variables