Most miners generate nonces entirely at random, if I am not mistaken. That's inherently flawed, there are much better ways to generate a "low" hash value.
If you know the range of input-output correspondance of a SHA256 hash, you can write one hell of a password cracker! Not sure if possible...