It's just reverse engineering. You want to find some kind of actions that let you cause non-standard behavior in the implementation of privileged libraries.