Do what master131 suggested and once you locate that first ammo address, set the debugger on it. Finding out what accesses it.
One instruction should be
Code:
004FF561 - 8b 84 ce c0 03 00 00 - mov eax,[esi+ecx*8+000003c0]
With that you can add ammo to any weapon with a very simple CE script. Heres an example AA script.
Code:
[Enable]
alloc(Cave,128)//Allocates a codecave
Cave://Our cave
mov [esi+ecx*8+000003C0],03E7//New instructions
jmp 004FF568//jump to the next instruction
004FF561://Our accessed address
jmp Cave//jump to the cave
db 90 90//nop extra bytes since the jump only requires 5 bytes
[Disable]
004FF561:
mov eax,[esi+ecx*8+000003c0]//Write the original instructions back
dealloc(Cave)//Deallocate the cave
Since we cant just write the new instruction over the old one, that requires
too many bytes and would just overwrite other bytes and crash the game. CE can allocate some memory using virtualalloc and free up some unused memory.
So we can jump from the old instruction to our new location where we put the new instruction. That type of jump only requires 5 bytes. Once you write the instructin, in this case adding 999 bullets to the gun, it'l jump back to the next instruction so the game will continue to run like normal.
Hope this helps ya, im not very good at explaining things. Im a doer,not a thinker.