This web page provides extra details about what a Bitcoin miner does. The simpified version is here.
What is a Bitcoin miner hashing?
A Bitcoin miner hashes a block header to determine it's hash value and hopefully find a Bitcoin block.
The structure of a block header is an 80 byte binary data set, defined as follows:
Previous Block Hash
Of the above set, we can safely vary 2 things in the miner: Merkle Root and Hash Nonce. Version is varied for overt Asic-Boost. Block Time shouldn't be varied since it is unnecessary and has limits on it's value. Block Time is not when the block was found, it is usually the time the work was sent to the miner. Previous Block Hash and Bits must, of course, not be modified since they must match the current Bitcoin network.
Normal hashing is to setup everything except the Hash Nonce and then count the Hash Nonce from 0 to 232-1 and hash each one. Hashing the full Nonce range from 0 to 232-1 is also called 1 Difficulty.
With stratum we can modify the Merkle Root to generate a different block header to hash the Nonce range. The Merkle Root is a hash tree of the transactions we include in the block, however there's one transaction that we can change with stratum, and that is the coinbase transaction - or the transaction that pays the miner. In this transaction we only need to make sure that:
It's a valid transaction - which is actually pretty random for the coinbase transaction due to the "sig" being allowed to contain almost anything as long as it starts with the block height
It pays out to the expected address we want to receive the generated Bitcoins
The amount it pays is correct: it matches the current block reward + the total fee in all the transactions
So for stratum we put a bunch of other 'nonces' in the coinbase "sig", that includes a unique number for each miner, and run the others from 0 up to some specified limit to generate a different coinbase transaction each time, that will generate a unique Merkle Root, to be put in a block header, to be hashed over the full Nonce range.
Thus with a unique number for each miner, and the miner itself following the stratum rules for creating coinbase transactions, the miner can keep generating a large amount of work that isn't expected to run out before the pool sends it new work. The miner also doesn't need to waste time processing bitcoin network information or verifying transactions, that is the job of the pool and requires fast global internet access, a very fast CPU and lots of RAM. It only needs network access to the pool or even just a local mining proxy, and spends all it's effort on processing work and hashing nonces.
Every time the miner finds a hash value that is greater or equal to the Difficulty specified by the pool, the miner sends the nonce and the "sig" nonces back to the pool. The pool hashes those nonces with the data it sent to the miner, and thus verifies it's valid, and thus rewards the miner with the Difficulty of the work sent to the miner.
The miner can't modify the payout address to 'steal' the block. The reason is that the pool wont get a valid hash of the nonces sent back if the coinbase the miner used doesn't match the coinbase information for the work it was given, so the share will be invalid and the miner will get no reward. Simple 🙂
Unlike the simple dice rolling example on the other page, the Bitcoin dice has 2256 sides or ~1.158x1077. There's also more than one solution that is valid. Any "side of the dice" that has enough zeros on the front, and is less than a specific value, is a Bitcoin block. Of that ~1.158x1077 number of sides, the current network Difficulty (Nd) decides how many mean we found a block.
The current network Difficulty is "0x1709a7af" which is called "Bits" and is 4 bytes of the data the miner hashes. (see above) The "0x17" = 23 and 32-23 = 9 bytes of leading zeros - i.e. 9 times '00' The rest is "09a7af". So what those 2 numbers mean is that any share with a hash value of: H=0x00000000000000000009a7af0000000000000000000000000000000000000000 or less would currently be a block.
If you divide ~1.158x1077 by H and divide it again by 0x100000000 (232) you will get that network Difficulty number: Nd = 29,152,798,808,271.9 Which means that every 232 times you roll the Bitcoin dice, i.e. hash a full nonce range, you have a 1 in 29,152,798,808,271.9 chance of finding a block.
... and the reason we divide by 0x100000000 again is that the network Difficulty number of 1 represents 232 hashes