HIT2012 Wargame Writeup : Binary 1

This writeup is about problem Binary 1 in HITCON 2012.
There is the description about  Binary 1:
Kenny 意外地從探險家手上獲得了一張海外的藏寶圖，但看起來似乎失去了下半部分，你能幫助他找到寶藏嗎??
And there is a kenny.zip  provided , which contain a Keyexe.jpge file inside.

We can observe that Keyexe.jpge can open by double-click , but can not open by image editor such as paint.So we can infer that Keyeze.jpge is not a jpge file but an exe file , which use windows reverse file name method to hind itself.[資料補充~~] 

After change the file name to key.exe, we can open it by debugger(because origin filename include invalid character).

We can find out that jpge file showed is 2.jpge in temp directory. After short analyse , we can find out there are 3 files create while execution.Those files are 1.jpge,2.jpge and SYS. 1.jpge is an image file contain "ioctl: 6666" message.SYS is device driver. Now we can guess next step is to register this device and send 6666 message to it through IOCTL.

By using IDA or ollydbg , we can find device name is Kenny.Then we can write a small program to send message to driver.Then driver will response "Boracay.exe" in debug message. Finally we change the original executable's  filename to Boracay.exe and execute it.The key "hey it nice" will displayed in DebugView.
[補充圖片]


ps. thanks for kost0911's sharing .He's article help me to find out device name , so I can complete this problem.
http://kost0911.pixnet.net/blog/post/91590907