How does the bullseye coverage tool work?

This is a tool-agnostic question. All of them including the bullseye coverage tool work the same way: they instrument the code of your system. Each time a line or branch of your code is visited at runtime, the tool caches this information. Afterall, the number of visited lines (or branches) is divided by the total number of lines (or branches). This is done in the scope of a single class/file, package, packages subtrees and whole application.

The code instrumentation can be, however, tool- and language-specific.

Here you will find more info, links and research papers on how to implement code coverage tools yourself and how instrumentation in example tools is done.