That is correct if you use the nofalldamage addy. But it is easier for you to use the addy of the class + the offset. But that is a thing you need to find out your self
You can find the addy and offset in olly. Look in Cshell.dll
Crossfire was so nice to leave the strings there:
Code:
1012AF4F 68 DC072F10 PUSH 102F07DC ; ASCII "DamagePerMeter"
1012AF54 50 PUSH EAX
1012AF55 E8 76421800 CALL 102AF1D0
1012AF5A 83C4 08 ADD ESP,8
1012AF5D 3BC7 CMP EAX,EDI
1012AF5F 74 1B JE SHORT 1012AF7C
1012AF61 8B48 04 MOV ECX,DWORD PTR DS:[EAX+4]
1012AF64 8B51 04 MOV EDX,DWORD PTR DS:[ECX+4]
1012AF67 8B42 04 MOV EAX,DWORD PTR DS:[EDX+4]
1012AF6A 50 PUSH EAX
1012AF6B 90 NOP
1012AF6C E8 046E4D5A CALL MSVCR80.atof
1012AF71 A1 CC5EA610 MOV EAX,DWORD PTR DS:[10A65ECC]
1012AF76 D958 04 FSTP DWORD PTR DS:[EAX+4]
1012AF79 83C4 04 ADD ESP,4
1012AF7C 8B4C24 2C MOV ECX,DWORD PTR SS:[ESP+2C]
1012AF80 3BCF CMP ECX,EDI
1012AF82 74 0D JE SHORT 1012AF91
1012AF84 8B4424 30 MOV EAX,DWORD PTR SS:[ESP+30] ; kernel32.7481339A
1012AF88 2BC1 SUB EAX,ECX
1012AF8A C1F8 02 SAR EAX,2
1012AF8D 3BE8 CMP EBP,EAX
1012AF8F 72 0A JB SHORT 1012AF9B
1012AF91 90 NOP
1012AF92 E8 FDDA4B5A CALL MSVCR80._invalid_parameter_noinfo
1012AF97 8B4C24 2C MOV ECX,DWORD PTR SS:[ESP+2C]
1012AF9B 8B0CA9 MOV ECX,DWORD PTR DS:[ECX+EBP*4]
Reverse this.
Then you can see that there is a float pointer in here.
Code:
1012AF71 A1 CC5EA610 MOV EAX,DWORD PTR DS:[10A65ECC]
1012AF76 D958 04 FSTP DWORD PTR DS:[EAX+4]
You can find out to look at the other "Variabels" that 10A65ECC is the address of the "playerclass".
So this is the "Link" to that "variable":
Code:
cshell + 0xA65ECC + 2C = //"No fall damage" if you put it on 0.0f
This is equal to: