Oh my god, you're the best coco!
I already had an address found with CE (0x1684B) although I did tried yours and it worked great.
Then I did what you said, more or less and it worked damn great!
[EDIT1](Hugh, maybe I didnt understood you completely, right now any values hitting 2 gets set to 255, ammos are changed when hitting 2 and same with kills value.)
(Anyhow i'll be re-reading your post a dozen time and be working on it.)
[EDIT2] Well now I do understand what you mean, just a matter of time before i figure out how to do it properly
[EDIT3] There it is!
I believe this is exactly what you told me to do, and it works perfectly.
[EDIT4]Heh.. Actually it was a bit off, fixed the script but didnt corrected the code box below.
Code:
offset 0x0041683E
jmp 0x00726000
nop
nop
nop
nop
nop
nop
nop
nop
offset 0x00726000
add ESP,24
cmp ESP,0018F204
jne 00726011
mov ecx,255
sub ESP,24
mov [esi],ecx
mov eax,00000001
mov ecx,[esp+1C]
xor ecx,esp
jmp 0x0041684B
nop
nop