Presented online for the first time is CU Amiga magazine 1992-10
Presented online for the first time is CU Amiga magazine 1992-10
Presented online for the first time is CU Amiga magazine 1991-02 (February)
Presented online for the first time is Amiga User International 1991-04 (April)
Cracking at Scale
Presented by Mark Pilgrim
Notes by Jeremy Barr-Hyde
Thursday 20 July 2017
6hr 06 min in
Revised 25-26/07/2017 with input from presenter and reviewing the presentation.
14:30 Joke: Where does the cracker throw all his dirty bits when company comes over? Under DESYNC! Tough crowd.
14:32 Cracking math blaster
Bootloader is encrypted with a one byte key and every disk is different! Capture the decrypted version.
Find the Weakbits protection check nestled in between the regular disk reading code. This reads track 0 sector 0, address epilogue twice and makes sure it’s different every time. This was a fun trick used by many different protection schemes to ensure that the storage medium returns random data. Sounds insane.
Rotating address prologues different on every track. Normalise that!
Different nibble translation table… just slightly different – normalise.
RWTS swapper to accommodate save game and data disc – side 2. Disable.
Disk volume number is 000 which is literally impossible to create with standard tools. Checked at runtime, repeatedly!
A BASIC program changes its environment and re-runs itself to reveal a new BASIC program! Which then changes its own environment again, e.g. changing the Applesoft program area.
The second level changes environment again and runs itself again. Third level changes and then program run. And it checks for volume number 000 again.
Embedded serial numbers – erase!
The entire DOS system is compatible with 3.3 but all entry points are shifted 2 bytes to the left. Essentially producing thousands of points for later copy protection checks. So, if you get through ALL of that, you get… Math Blaster! Still no clapping?
So, what if you wrote a program to do all of that? Mark explains step by step the patches while referring to an example Passport log on slide. From that you get Overview of the Bible (1983). And you get From this other programs such as the Bingo Bugglebee series (1985) and Grasshopper Dissection in 1990 (7 years on). Audience comment: Grasshopper Dissection? Sounds like a metal band name!
And Ultimo IV uses the same protection – now I have your attention.
Trivia: First to be de-protected? Ultima IV. Lead way for preservation of the previously mentioned titles. And we see this pattern over and over again.
If you can crack Spanish Achievement 1, you have Spanish Achievement 1. If you can automate that routine with a program, you then get English Achievement 1. Joke: It’s a little involved (Mark referring to a slide showing complex patches). Not others of course – it’s copy protection. Ardy the Aardvark, Datamost, splash screen on show (with appropriate composite CRT filter applied). You can conclude the original cracker of Ardy the Aardvark did not go back and crack Flash Spell Helicopter (1983) when he or she was done.
Cracking Ernie’s Quiz
You get Ernie’s Quiz.
Shout out to Catherine (not present).
But Passport allows for further cracking of very early educational and productivity software. Titles include Instant Zoo (1981); Letter Man (1982) and Shopping with the Yellow Pages (1984). Apple themselves created this copy protection and licensed it to publishers. A range of titles are shown on slide. Magic Spells (1981) published by Advanced Learning Technologies, later rebranded to The Learning Company who went on to published Rocky’s boots and many more. The Speed Reader (1981) was the very first program by Jan Davidson, who later founded Davidson & Associates. Her doctorate was in American Studies; she was a teacher.
Elite, D. Braben (1985). Space simulation/strategy game with 3D wire framing and exactly the same protection as Ernie’s Quiz.
Mark: Passport has improved since the last time I was here and presented in 2016. It now has a universal Activision patcher, courtesy of Brian Troha (present for applause).
All of these big-name Activision games such as Shanghai, Rocky Horror Show; you find the common protection code then you can crack all these games (list of titles shown). Including How to Weigh an Elephant, Litag… for free! That isn’t an Activision product. So that copy protection was productised, and that version was then offered to other companies.
Disk duplication houses may have had a business of licensing protection routines. These didn’t stay in house necessarily.
Electronic arts are famous for their virtual machines and interpretative language, then wrote the CP in that language… if you get a universal patcher from Qkumba, thank you, that can crack movie Maker. We did a lot of construction in the 80s – Bards Tale leads to…. Financial Cookbook by EA! A short-lived attempt of EA’s in the 80s. They wrote a processor called cut and paste, which had the exact protection from Bard’s Tale. Guess what was cracked first?
Trivia: Qkumba has been very busy.
Anti-tamper checks – Nibble 14 minutes in.
Mr Cool is a cool Qbert clone. Apple Cider Spider
Trivia: Sammy Lightfoot favourite game of 4ams.
This is all now in passport. It’s an automatic disk verification and copy program. I’m back to Kfest to announce it has been under active development over the past 371 days.
Universal patching incorporates Activision as we know but other routines such as $BBF9 desync. John Brooks submitted his title ‘Tomahawk’ for de-protection. This isn’t the only title to be self-presented.
Gamco did games like Capitalization. Used Beagle compiler, poked a bad block check into memory then called it. It was fun! Actual fun may vary.
Self-destructing MECC disks – one thing they’d do is a master disk and then a limited boot backup which counts each use. 50 uses? I’m sorry you’ve booted this too many times, disk catalogue trashed along with data. master Disks were supposed to be mailed back to MECC. unlike modern software distribution where it takes seconds, it would have taken weeks for a replacement. Nasty. Passport takes care of this.
Fixes – SO MANY. Scholastic’ Grolier – edge cases. Passport can notify of ProDOS RWTS variants regardless of patches applied or not. This surfaced more information which goes beyond cracking.
Fundamentally a verification program and data miner. The raw material, the ore with diamond pick axe, … wait scratch that – too much Minecraft…
Passport is surfacing information about these disks that may or not be readily obvious. Things like third party DOSen. Apple DOS 3.3 was very slow so a market sprung up – diversiDOS. Shareware $30…. Mark didn’t pay.
A lot of educational programs used a real file system, except it was prontoDOS or diversiDOS. This is where these DOSen products made money.
All of this is new from the past year.
The upcoming release that was released in May, ready for download. Upcoming features are RAM Disk support – hardware supported include GS Ram disks, RamFast. Disks ready to memory, patched, written out. Exciting to take advantage of memory expansion. Again, thank you to Qkumba for development on this new feature.
The original version of passport (released at KFest 2016) was written and assembled in Merlin programming language. Now we have migrated to modern laptops for editing, assembling (open source software Acme).
Mark suggests github.com/a2-4am/passport for the code, welcomes contribution. Still runs on A][+ ć 64kb. RAM disk use is automatic.
2016 brought the announcement of 42 unpreserved disks being cracked by Passport. The past year has brought a total of titles 542! And of those, many are preserved for the first time – 425!
At Passport’s heart is a verification tool. Initially written to verify .EDD images that were made from collections. OpenEmulator //e by Zellyn Hunter can boot them, sure. But if a sector related to level 7 was corrupt, gameplay could not be guaranteed.
Automation; OE and Passport run with log file captured automatically.
*Hitchhikers guide to the galaxy reference.
What can you do with 4000 verified EDD disk images? AND the resulting .DSK images sans protection? And the .TXT file of the passport log?
This dataset proves that:
202 $E7 bit streams desynchronising check.
163 LSR $6A
see side for further
138 $DE + timing
13 JMP ($BBDE) – this page is later overwritten and moved.
This isn’t 202 disks from the same company, it’s from dozens of companies. Grolier, Sunburst, Troll (and more) all used and re-used protection that’s what Passport targets.
What can’t be done? Yes, it’ll be a Chess program (Qkumba, a grand master cracker) has spent hours on this). A lot of one offs (in the removal of protection) which deep dives into new routines.
protection is a valued added thing bought from duplication houses. E.G Troll’s Tale has two different versions and subsequent protection. helps beat Copy II plus for example.
Question posed about buying copy protection versus developing it in-house.
Answer: Mark was 11. His work is better than talking to someone about history (joke) but welcomes discussion on this topic.
John Brooks presents facts: Datasoft was in three groups. Disk duplication, development and warehouse (for physical distribution). Mid to late 80s where not all shops had access to copy protection tech, and customised duplication schemes that can do it…. Those that did were sought out… Those being companies that can also store and ship the product post duplication.
Mark: Copy protection is hard and has trade-offs. The programming required is very different in comparison to the game development itself. Broderbund had in house. Sirius too.
Reminder that this was a cat and mouse game – months after product release would bring a new version of Copy II Plus. Forcing expensive redevelopment of software.
A summary of DOSen used by publishing houses is shown, numbers showing the protection is built on top of the DOS. One is pronto-DOS which puts code on an unused part of Pronto-DOS which is used in other third party DOSen.
Trends, statistics and popularity can be summarised from the past year’s data mining.
A tale of two trolls (and so many sticky bears) appear identical in physical media. Booting, identical. Protection? Completely different. Someone had to have revised the game, leading to new protection. This complicates preservation when versions are different yet unlabelled.
Logs that are expected to be the same, but aren’t, is where the identification of these titles show up.
Sticky Bear is notorious for identical physical presentation yet protection routines applied to the same title can change up to four unique times.
Opportunities in future preservation workflows: Extraction, derivation, aggregation, investigation.
Before dinner time today, someone could build a tool to extract Applesoft source from a range of discs and save it to text file.
A hacked version of MECC’s copy program lead the way to a 32mb disk image, hard drive bootable of these titles. 40-50 titles per 32mb compilation.
Empowering users to make their own compilations of titles previously not hard drive bootable.
Cultural anthropology – take The Learning Company. Watch them progress through looking at early titles and seeing their progression as programming skills mature. Dr Leslie M Grimm of TLC used a then age 11 Corrine Grimm for in game artwork. Mark notes he can see the quality of artwork progress as Corrine gets older.
Mark: I don’t wonder anymore if this is worth doing. I don’t argue who think everything is preserved or judge what is worthwhile. I’ve seen what is rotting away on physical media.
MECC’s database on Soviet Union, which fell in 1991.
And Squgies’s book on drugs! Alcohol bad, vaccines good.
These are not just bits, disks, artefacts. They are curriculum. Kids USED this in the 80s. Especially considering MECC was single platform.
Last but not least.
(60L TUB is placed on the desk). Mar: This is about 600 MECC disks – I can personally guarantee each is imaged. I have checked the version numbers, checked gameplay, EDD imaged them and archived them. Then verified them with passport, then uploaded them to Archive.org. They are yours. PLEASE take them – and would someone help me carry them up (for garage giveaway).
Joke: Did you hear that honey? (toward the camera) – THEY ARE NOT coming home!
And last finally; I’m going to press C.
A demonstration, in less than 30 seconds’ completion, shows Ultima IV Origins being deprotected in Passport. Patches are applied in real-time to serial numbers, RWTS and more. A disk image is written to slot 5 drive 1 to a USB stick with a CFFA3000.
(mark goes to menu selection).
Ultima IV, origin, loads instantly.
Question: Who is 4AM?
Answer: I don’t know!
KansasFest 2017 Keynote
Date: Wednesday 19 July 2017
Notes by Jeremy Barr-Hyde
Revision 1 22/07/2017 feedback from Olivier and readability by myself.
Revision 2 31/07/2017 incorporating commentary on content from Antoine.
Revision 3 17/09/2017 incorporating further revisions from Olivier
13:30 Introduction to KansasFest with overview of the Apple II product history and release dates.
13:40 Giveaway of oscilloscope – Evan Koblenz of Vintage Computing Federation (VCF) presents. Trivia: ’76 in New Jersey the Apple II was ready but delayed until Apple 1s were sold. VCF are presenting a forum next February. Building a hobby knowledge base. Steve Wozniak personally writes a supportive statement for the VCF.
Anthony Martino is the winner of the oscilloscope.
13:45 Lanyard colours – Staff = Black; Blue = Photos ok, Red = no photos please.
Code of conduct – harassment free across all diversities.
Dagen encouragement for hoarding.
Prizes awarded to those fortunate to have one or two dots on their Kfest 2017 pins.
13:50 Jason Scott assures members where camera and microphones are located and how to take best advantage of them. Encourages volunteers for management of live streaming equipment.
Dagen introduces keynote to be presented by Brutal Deluxe Software. Titles include: Cadius disk imaging, Merlin32 cross assembler, I’m fEDDup, Mount it and more. Praise for their incredible job archiving audio cassette based Apple II software; collection of serial numbers for the Apple IIGS. Highlight of their audio tools introduced in 2017 for tracking instruments.
13:55 Setup of Brutal Deluxe presentation and warm welcome from Antoine. Antoine dons Antoine Vignau t-Shirt and Olivier one with multiple choice surnames such as Olivier … Bailly-Maitre, Goguel and more. Kind reminder of their French origins and pride from growing up with Apple 8-bit computers. Slide title: ST-able of contents: Atari ST; the French market. ST-he French Models and market. More than 6,000,000 sold between 1985 to 1993 (8 years) thanks to high availability of software. ST-he competition: Apple IIGS
1400: The way we were France declared, officially, as the centre of the world! 1980s … where 8-bit computers ruled the world. The British had Sinclair Spectrum and Acorn BBC Micro (6502 based). Also Dragon Data with Dragon 32 6809 at 0.9Mhz; Tangerine Compute Systems with Oric models based again on 6502 at 1 MHz. United States of America sell the TI-9/4A at 3.3MHz; Mattell Aquarius; Tandy-Radio Shack (TRS) 80; Atari 800XL with 6502 at 1.7MHz and Antic co-processing for graphics and the XE for gaming.
Further brands: Commodore’s VIC 20 and 64. Finally Apple //e 1983 and Apple //c 1984 hitting the market for $2,000. Apples for home use were either brought home from work over the weekend or owned by the very wealthy. France present the Alice based on 6803 which sold in bright red and shipped including two manuals one for Assembly and one for Basic. Olivier explains the beauty of SCART which brinGS R,G,B and sync on composite and standard on all consumer televisions for a very clear picture (compared to RF modulation in the US).
France feature Phillips and Excelvison brands, featuring infrared input devices and slim-line design. Thomson offering 3 models 1982-1986 based on the 6809 at 1Mhz sold to educational markets and have light pen input. Microsoft Basic was edited to remove their copyright. Thomson later introduced the failed TO 8 and 9 but lost out to 16-bit. Moving on to Britain with Amstrad 464 and 6128, based on the Z80 at 4MHz. Amstrad planned for ease in connection by bundling the monitor and building in the cassette and later 3-inch removable disk. The game players choice was the Amstrad for 16 colour and price. So across generations there are over 20 models and little range of software.
14:15 Olivier continues to explain magazines and newspapers, published up to a weekly basis of basic programs for home users to re-key at home for software. Antoine explains archiving efforts of such programming magazines include manual re-key! TILT magazine was exclusive to gaming news and software, presented in full colour print. The 8-bit market had few succeeding companies, and most of them did not continue with a 16 bit model. The only four different 16 bit computers were introduced ~1985-1987, all starting with the letter A: Atari ST, Amiga, Apple IIGS and Archimedes.
1984 Macintosh release was taken very seriously with the introduction of the Macintosh II costing the same price as a new car. The real market winner was the Atari ST, especially the 1040STf* with built in 720kb floppy drive and RGB SCART, selling for $600 compared to the Apple IIGS at $2000. *1040 represents 1mb RAM; Lowercase f – floppy.
14:20 The 1985 Commodore Amiga 1000 was again expensive and sold as a graphic workstation yet limited to 4096 colour palette. 1987 remarketing efforts had it sold primarily as a gaming machine = the Amiga 500 as a cost reduced model 1000 with almost exact specifications (Motorola 68000 at 7.14 MHz and stock 512kb fast ram). Porting Amiga software to the Atari ST was relatively easy. This prompted many game titles to be available for sale and on BBS.
The IIGS was more of a challenge. Back to 1986 saw the Apple IIGS with the 65816 CPU clocked down to 2.8Mhz and 256KB of stock RAM or 128kb RAM as sold in France with entry price point of $2000-$3000. I clarified this price of the IIGS, answer is that included a single 800kb floppy and Apple RGB monitor.
The Apple IIGS used on display at the 1987 Apple Expo were cleared at $200, this how ACS /FTA members (Gogs, Deny and SPK) could catch them at a decent price. Expo 1987 had the IIGS cleared at the $200 price point.
A question about the USA pricing has Olivier explain Jack Tramiel understood the market better as he recognised price as a major factor in success.
Amiga had 3000 games, Atari ST – 2000 and the Apple IIGS on 250 including shareware. European published software titles were rarely sent to the USA with quick piracy being attributed in part to this. Despite the large number of titles, competition had pushed the quality of games to a high level. One Sega title was licensed very cheaply from Japanese headquarters and ported to the ST by programmers filming arcade cabinets to recreate the game. The game title was Space Harrier.
14:30 Acorn Archimedes in 1987 represented the fastest computer for home use at 4.5 MIPS (RISC ARM 32 bit 8 Mhz). 1995 – 2000 has Personal Computers (IBM Compatible) overtake the market. Wing Commander’s VGA graphics and Sound Blaster sound quality really took the market by surprise as the Amiga couldn’t match it. Also favouring PC was modem internet connectivity in Windows which could not be matched by 16-bit Amiga and Atari computers.
14:35 The 16-bit Demo scene provided amazing graphics and sound that tried to compete with VGA graphics. A humorous reminder that our presenters are still Apple II loyal. Main presenter is back to Antoine who begins with 1977 as the early with ISTC and Sonotec. Apple II computers were imported from the USA to make it compatible with French standards such as RGB display cards and light pen input. Interestingly distribution rights for Apple were given to Sonotec who kept the original computer name. Others had to rename them. The expensive pushed it towards business use with accounting programs. French translated versions of US software started the market, with titles such as Star Trek. Jean-Louis Gassée took over and made a huge impact on the French ][ market. He was very active in developer meetings and awards. At the end of 1983, 150k Apple ][ computers were in France.
Ciel Bleu has software like translated Sargon III (chess). This company tried to reproduce the manuals including humour in US documentation. A demonstration of original warranty cards and packing lists were shown with low hardware serial numbers.
14:45 Rare Apple Expo 1984 T-Shirt was shown. With the introduction of the Macintosh to France so came discontinuation of the Apple II support, including the Apple IIGS. Olivier and family purchased the Apple IIGS in 1989 with educational discount. The Apple IIGS shipped with free boxed copies of GS/Paint and GS/Write, however US equivalents were published by different companies such as Activision. Magazines dedicated to the Apple II include Poms which began print release before the Apple II was for sale. Tremplin Micro focused more on programming (1985-1990). Fanzines helped the market continue. A special Apple IIGS programming book was produced.
14:50 Club Apple, 1984, started subscribing people to an information exchange like service. Also sold were disks at around $5 each, copy protected. one of the most famous clubs was GS/Club started in 1989 and lasted until 2000. Brutal Deluxe have archived 66 (all) of this club’s magazine and more than 450 floppy discs. A compilation CD was issued. International agreements for software were made with publishers such as Spinnaker and Ediciel to translate and distribute in France. It was a one way agreement, meaning Ediciel titles were never translated to English for sale in the USA. Version Soft (publisher of GS Paint/Write) were successful in making an agreement with Activision for GS Paint -> Paintworks and GS Write -> Writer’s Choice Elite. Broderbund has Chairman brought over for sale in the USA, titled ‘Show Off’.
14:55 Version Soft sold more than 300,000 Apple II software titles by end of 1986. Remarkable people: Pierre Berloquin for networking company Créalude with the game Time City. Another is Chris Market who wrote Dialector and more. “Ordigrames” were a French team who wrote games on the Macintosh for the Atari ST, Commodore Amiga, Macintosh and IIGS. Titles include Shuffle-Puck Cafe; Bubble Ghost; Project Neptune and more.
15:05 Brutal Deluxe is a business partnership formed in early 1990s thanks to a users meeting in Bordeaux, France. Both owned the Apple IIGS and tried to master a snooker game. More than one ball was too difficult. 1992 brought The Tinies, 10,500 lines of code, 3,200 colour pictures and an arcade game that was popular for addictive gameplay. The creation of the game was made easier with help from others. The title screen was in 256 colour which beat the competitors 16 colour limit. Competition for increasing colour depth on screen ensued. 1994 brought Cogito with 13,700 lines of code. A greyscale version was released in 1994 and 1998 brought colour 320×200 graphics. The Second Sight VGA board allowed for 640×400 resolution in 256 colours.
15:10 1995 brought Convert 3200 as a fast tool for importing or exporting graphics. 36,100 lines of code. 1996 a CD-ROM full of IIGS software sold only in France DeluxeWare.
15:15 LemminGS = 26,000 lines of code with only the ST version available as a working source. 8 months, full time work. 4 months dedicated to sprite extraction with each lemming at 20 sprites each. SynthLab music. Documentation of individual, hand coded lemminGS.
Graphics from ST,
Music from PC MIDI
Sound effects from Macintosh resource file
Title screen from Amiga.
System utilities included utilities such as image viewer, ThirdView, TextEdit patch and translation of SSW 6.0.1 into French.
15:20 Trivia: IIGS CODE NAMES: Phoenix, Cortland, Vegas, Mad Max, Columbia. The code name was changed monthly. GS stood for Graphics & Sound, Goodbye Steve and Great Shit.
Brutal Deluxe restart their efforts to crack software copy protection, produce software such as MountIt and BenchmarkeD. Development of some titles aided by late contribution to the team of source code. A reminder that softer cassettes are a major preservation focus with ~660 titles known to exist. Also preservation efforts are on manuals, software dissemble for ROM 03 compatibility and basic code for hardware markers. I’m fEDDup is related to DotNIB and development can retire thanks to Applesauce disk imaging workflows (John Keoni Morris). Brutal Deluxe have also restored source code from IIGS hard drives owned by Huibert Aalbers.
15:25 And finally a release of the game Zéphyr on physical media. La Crapule is also coming to boxed, physical media.
Second part of presentation is introduced with Olivier beginning a slide ‘The cross-dev tools!”. A full set of utilities to enable the creation of new Apple IIGS software. He explains it is logical to create software for the IIGS on modern PCs. Many times the hardware limitations of the IIGS are reached, making PC development more ideal. Explanation of assemblers and step by step cycle counting which is used in a simulator for breaking apart code. Olivier comments the creation of game assets is much harder than the binary. The Apple IIGS need a more creative graphic style compared to the //e. Hence the idea of being able to extract any game resource using Resource catcher. Small scale C compilation is approachable but quickly becomes inefficient for gaming. Algorithms are helpful such as LZ4.
15:30 Apple IIGS migration factory – 50% of the project is done and aims to reduce development time of porting Atari ST/ Amiga titles to the IIGS.
Conclusion of slides and one more thing. Olivier suggest a game does not exist but can produce box, disc and documentation. From this a game is inspired. The aim is to offer products for our market.
Presented here is the disk image and now manual for MasterType version 1.7.
The manual was found separate from any disks at the 2017 KansasFest garage giveaway. Brought home in my luggage for scanning at home on the ScanSnap.
Scroll to down to M for MasterType:
Presented here is a combination of 4AM’s release of the cracked disk image and my scan of the manual for Minus Mission by DLM.
Scroll to down to M:
A 4am crack 2017-06-28
Name: Minus Mission
Version: 1985 revision
Credits: Jerry Chaffin, Bill Maxwell,
1985 revision by Allen Colebank
Publisher: Developmental Learning Materials
Platform: Apple ][+ or later
Media: single-sided 5.25-inch floppy
OS: Diversi-DOS C1983
This disk was automatically cracked by
Passport. Here is the transcript:
Reading from S6,D1
T00,S00 Found Diversi-DOS bootloader
Using disk’s own RWTS
Writing to RAM disk
T00,S03,$91: AA -> DE
T00,S03,$9B: DE -> AA
T00,S03,$35: AA -> DE
T00,S03,$3F: DE -> AA
T00,S06,$AE: AA -> DE
T00,S06,$B3: DE -> AA
T00,S02,$9E: AA -> DE
T00,S02,$A3: DE -> AA
Writing to S6,D2
More information and source code is
Quod erat liberandum.
Copyright (C) 1991 by Larry Pina
Keyed from the rear: “…Shows you how to open the box to the entire family of Macintosh II computers and fully reveals their inner workings.”
Copyright (C) 1993 by Larry Pina
Summary from rear: “…This book covers 95 percent of all common failures, upgrades and adjustments. Covers the following models: Classic, Classic II, SE, SE FDHD, SE/30”.
High quality scan.
Strategic Simulations Incorportated (SSI) published a large line of games for the Apple II computer. Their imaginative box art helps gloss over the often texted based gaming experience.
Presented here are scans of the boxed Apple II SII software held by a fellow Canberra enthusiast. At the time he gave them to me, Passport by 4AM was brand new and I didn’t have an EDD card. Becuase they were protected, I am happy to present the box art scanned with an Epson Perfection V700 by yours truly.
Thank you to @yesterbits for reminding me I had done these and should share these full resolution files:
Computer Baseball – SSI
Computer Quarterback – SSI
Fighter Command the Battle of Britain – SSI
The Warp Factor – SSI
Previews of the box art below: