> Is it just having a ton of knowledge about hardware / lower-level OSes?

Pretty much, yes. And knowing about common exploit strategies (the crypto engine partial overwrite for example is a classic one).