I don't know how to write a script, i usually find address by using the opcode in CE.
Code:
Warframe.exe+2F36D0 - 55 - push ebp
Warframe.exe+2F36D1 - 8B EC - mov ebp,esp
Warframe.exe+2F36D3 - 83 E4 F8 - and esp,F8
Warframe.exe+2F36D6 - 81 EC 94000000 - sub esp,00000094
Warframe.exe+2F36DC - 53 - push ebx
Warframe.exe+2F36DD - 8B 5D 08 - mov ebx,[ebp+08]
Warframe.exe+2F36E0 - 56 - push esi
Warframe.exe+2F36E1 - 57 - push edi
Warframe.exe+2F36E2 - 8B 43 18 - mov eax,[ebx+18]
Warframe.exe+2F36E5 - 8B 4B 14 - mov ecx,[ebx+14]
Warframe.exe+2F36E8 - 8B 51 04 - mov edx,[ecx+04]
Warframe.exe+2F36EB - 89 44 24 0C - mov [esp+0C],eax
Warframe.exe+2F36EF - 8B 02 - mov eax,[edx]
Warframe.exe+2F36F1 - 8B 50 10 - mov edx,[eax+10]
Warframe.exe+2F36F4 - 89 44 24 24 - mov [esp+24],eax
Warframe.exe+2F36F8 - 8B 42 08 - mov eax,[edx+08]
Warframe.exe+2F36FB - 89 44 24 1C - mov [esp+1C],eax
Warframe.exe+2F36FF - 8B 4B 0C - mov ecx,[ebx+0C]
Warframe.exe+2F3702 - 89 4C 24 10 - mov [esp+10],ecx
Warframe.exe+2F3706 - 8B 74 24 0C - mov esi,[esp+0C]
Warframe.exe+2F370A - 8A 43 38 - mov al,[ebx+38]
Warframe.exe+2F370D - 8B 3E - mov edi,[esi]
Warframe.exe+2F370F - 83 C6 04 - add esi,04
Warframe.exe+2F3712 - 89 74 24 0C - mov [esp+0C],esi
Warframe.exe+2F3716 - 88 44 24 2B - mov [esp+2B],al
Warframe.exe+2F371A - A8 0C - test al,0C
Warframe.exe+2F371C - 0F84 B3000000 - je Warframe.exe+2F37D5
Warframe.exe+2F3722 - FF 4B 40 - dec [ebx+40]
Warframe.exe+2F3725 - 8B 4B 40 - mov ecx,[ebx+40]
Warframe.exe+2F3728 - 74 08 - je Warframe.exe+2F3732
Warframe.exe+2F372A - A8 04 - test al,04
Warframe.exe+2F372C - 0F84 A3000000 - je Warframe.exe+2F37D5
Warframe.exe+2F3732 - 8B 53 18 - mov edx,[ebx+18]
Warframe.exe+2F3735 - 89 54 24 20 - mov [esp+20],edx
Warframe.exe+2F3739 - 89 73 18 - mov [ebx+18],esi
Warframe.exe+2F373C - A8 08 - test al,08
Warframe.exe+2F373E - 74 1B - je Warframe.exe+2F375B
Warframe.exe+2F3740 - 85 C9 - test ecx,ecx
Warframe.exe+2F3742 - 75 17 - jne Warframe.exe+2F375B
Warframe.exe+2F3744 - 8B 43 3C - mov eax,[ebx+3C]
Warframe.exe+2F3747 - 6A FF - push FF
Warframe.exe+2F3749 - 6A 03 - push 03
Warframe.exe+2F374B - 53 - push ebx
Warframe.exe+2F374C - 89 43 40 - mov [ebx+40],eax
Warframe.exe+2F374F - E8 3C5BFFFF - call Warframe.exe+2E9290
Warframe.exe+2F3754 - 8A 44 24 37 - mov al,[esp+37]
Warframe.exe+2F3758 - 83 C4 0C - add esp,0C
Warframe.exe+2F375B - A8 04 - test al,04
Warframe.exe+2F375D - 74 65 - je Warframe.exe+2F37C4
Warframe.exe+2F375F - 8B 4B 14 - mov ecx,[ebx+14]
Warframe.exe+2F3762 - 8B 51 04 - mov edx,[ecx+04]
Warframe.exe+2F3765 - 8B 02 - mov eax,[edx]
Warframe.exe+2F3767 - 8B 48 10 - mov ecx,[eax+10]
Warframe.exe+2F376A - 8B 51 0C - mov edx,[ecx+0C]
Warframe.exe+2F376D - 8B 49 14 - mov ecx,[ecx+14]
Warframe.exe+2F3770 - 8B C6 - mov eax,esi
Warframe.exe+2F3772 - 2B C2 - sub eax,edx
Warframe.exe+2F3774 - C1 F8 02 - sar eax,02
Warframe.exe+2F3777 - 48 - dec eax
Warframe.exe+2F3778 - 85 C9 - test ecx,ecx
Warframe.exe+2F377A - 74 09 - je Warframe.exe+2F3785
Warframe.exe+2F377C - 8B 34 81 - mov esi,[ecx+eax*4]
Warframe.exe+2F377F - 89 74 24 18 - mov [esp+18],esi
Warframe.exe+2F3783 - EB 08 - jmp Warframe.exe+2F378D
Warframe.exe+2F3785 - C7 44 24 18 00000000 - mov [esp+18],00000000
Warframe.exe+2F378D - 8B 74 24 0C - mov esi,[esp+0C]
Warframe.exe+2F3791 - 85 C0 - test eax,eax
Warframe.exe+2F3793 - 74 1F - je Warframe.exe+2F37B4
Warframe.exe+2F3795 - 8B 44 24 20 - mov eax,[esp+20]
Warframe.exe+2F3799 - 3B F0 - cmp esi,eax
Warframe.exe+2F379B - 76 17 - jna Warframe.exe+2F37B4
Warframe.exe+2F379D - 85 C9 - test ecx,ecx
Warframe.exe+2F379F - 74 0B - je Warframe.exe+2F37AC
Warframe.exe+2F37A1 - 2B C2 - sub eax,edx
Warframe.exe+2F37A3 - C1 F8 02 - sar eax,02
Warframe.exe+2F37A6 - 8B 4C 81 FC - mov ecx,[ecx+eax*4-04]
Warframe.exe+2F37AA - EB 02 - jmp Warframe.exe+2F37AE
Warframe.exe+2F37AC - 33 C9 - xor ecx,ecx
Warframe.exe+2F37AE - 39 4C 24 18 - cmp [esp+18],ecx
Warframe.exe+2F37B2 - 74 10 - je Warframe.exe+2F37C4
Warframe.exe+2F37B4 - 8B 4C 24 18 - mov ecx,[esp+18]
Warframe.exe+2F37B8 - 51 - push ecx
Warframe.exe+2F37B9 - 6A 02 - push 02
Warframe.exe+2F37BB - 53 - push ebx
Warframe.exe+2F37BC - E8 CF5AFFFF - call Warframe.exe+2E9290
Warframe.exe+2F37C1 - 83 C4 0C - add esp,0C
Warframe.exe+2F37C4 - 80 7B 06 01 - cmp byte ptr [ebx+06],01
Warframe.exe+2F37C8 - 0F84 AA130000 - je Warframe.exe+2F4B78
Warframe.exe+2F37CE - 8B 53 0C - mov edx,[ebx+0C]
Warframe.exe+2F37D1 - 89 54 24 10 - mov [esp+10],edx
Warframe.exe+2F37D5 - 8B C7 - mov eax,edi
Warframe.exe+2F37D7 - C1 E8 06 - shr eax,06
Warframe.exe+2F37DA - 25 FF000000 - and eax,000000FF
Warframe.exe+2F37DF - 8D 34 C5 00000000 - lea esi,[eax*8+00000000]
Warframe.exe+2F37E6 - 89 44 24 14 - mov [esp+14],eax
Warframe.exe+2F37EA - 8B C7 - mov eax,edi
Warframe.exe+2F37EC - 89 74 24 20 - mov [esp+20],esi
Warframe.exe+2F37F0 - 03 74 24 10 - add esi,[esp+10]
Warframe.exe+2F37F4 - 83 E0 3F - and eax,3F
Warframe.exe+2F37F7 - 89 74 24 18 - mov [esp+18],esi
Warframe.exe+2F37FB - 83 F8 25 - cmp eax,25
Warframe.exe+2F37FE - 0F87 02FFFFFF - ja Warframe.exe+2F3706
Warframe.exe+2F3804 - FF 24 85 884B6F00 - jmp dword ptr [eax*4+Warframe.exe+2F4B88]
Warframe.exe+2F380B - 8B 4C 24 10 - mov ecx,[esp+10]
Warframe.exe+2F380F - C1 EF 17 - shr edi,17
Warframe.exe+2F3812 - 8B 14 F9 - mov edx,[ecx+edi*8]
Warframe.exe+2F3815 - 8D 3C F9 - lea edi,[ecx+edi*8]
Warframe.exe+2F3818 - 89 16 - mov [esi],edx
Warframe.exe+2F381A - 8B 47 04 - mov eax,[edi+04]
Warframe.exe+2F381D - 89 46 04 - mov [esi+04],eax
Warframe.exe+2F3820 - E9 E1FEFFFF - jmp Warframe.exe+2F3706
Warframe.exe+2F3825 - 8B 4C 24 1C - mov ecx,[esp+1C]
Warframe.exe+2F3829 - C1 EF 0E - shr edi,0E
Warframe.exe+2F382C - 8B 14 F9 - mov edx,[ecx+edi*8]
Warframe.exe+2F382F - 8D 3C F9 - lea edi,[ecx+edi*8]
Warframe.exe+2F3832 - 89 16 - mov [esi],edx
Warframe.exe+2F3834 - 8B 47 04 - mov eax,[edi+04]
Warframe.exe+2F3837 - 89 46 04 - mov [esi+04],eax
Warframe.exe+2F383A - E9 C7FEFFFF - jmp Warframe.exe+2F3706
Warframe.exe+2F383F - 8B CF - mov ecx,edi
Warframe.exe+2F3841 - C1 E9 17 - shr ecx,17
Warframe.exe+2F3844 - 89 0E - mov [esi],ecx
Warframe.exe+2F3846 - C7 46 04 01000000 - mov [esi+04],00000001
Warframe.exe+2F384D - F7 C7 00C07F00 - test edi,7FC000
Warframe.exe+2F3853 - 0F84 ADFEFFFF - je Warframe.exe+2F3706
Warframe.exe+2F3859 - 83 44 24 0C 04 - add dword ptr [esp+0C],04
Warframe.exe+2F385E - E9 A3FEFFFF - jmp Warframe.exe+2F3706
Warframe.exe+2F3863 - 8B 54 24 10 - mov edx,[esp+10]
Warframe.exe+2F3867 - C1 EF 17 - shr edi,17
Warframe.exe+2F386A - 8D 3C FA - lea edi,[edx+edi*8]
Warframe.exe+2F386D - 33 C0 - xor eax,eax
Warframe.exe+2F386F - 90 - nop
Warframe.exe+2F3870 - 89 47 04 - mov [edi+04],eax
Warframe.exe+2F3873 - 83 EF 08 - sub edi,08
Warframe.exe+2F3876 - 3B FE - cmp edi,esi
Warframe.exe+2F3878 - 73 F6 - jae Warframe.exe+2F3870
Warframe.exe+2F387A - E9 87FEFFFF - jmp Warframe.exe+2F3706
Warframe.exe+2F387F - 8B 44 24 24 - mov eax,[esp+24]
Warframe.exe+2F3883 - C1 EF 17 - shr edi,17
Warframe.exe+2F3886 - 8B 4C B8 14 - mov ecx,[eax+edi*4+14]
Warframe.exe+2F388A - 8B 41 08 - mov eax,[ecx+08]
Warframe.exe+2F388D - 8B 10 - mov edx,[eax]
Warframe.exe+2F388F - 89 16 - mov [esi],edx
Warframe.exe+2F3891 - 8B 40 04 - mov eax,[eax+04]
Warframe.exe+2F3894 - 89 46 04 - mov [esi+04],eax
Warframe.exe+2F3897 - E9 6AFEFFFF - jmp Warframe.exe+2F3706
Warframe.exe+2F389C - 8B 4C 24 24 - mov ecx,[esp+24]
Warframe.exe+2F38A0 - 8B 51 0C - mov edx,[ecx+0C]
Warframe.exe+2F38A3 - 8B 4C 24 1C - mov ecx,[esp+1C]
Warframe.exe+2F38A7 - 8B 44 24 0C - mov eax,[esp+0C]
Warframe.exe+2F38AB - 89 54 24 54 - mov [esp+54],edx
Warframe.exe+2F38AF - 56 - push esi
Warframe.exe+2F38B0 - C1 EF 0E - shr edi,0E
Warframe.exe+2F38B3 - 8D 14 F9 - lea edx,[ecx+edi*8]
Warframe.exe+2F38B6 - 89 43 18 - mov [ebx+18],eax
Warframe.exe+2F38B9 - 52 - push edx
Warframe.exe+2F38BA - 8D 44 24 5C - lea eax,[esp+5C]
Warframe.exe+2F38BE - 50 - push eax
Warframe.exe+2F38BF - 53 - push ebx
Warframe.exe+2F38C0 - C7 44 24 68 05000000 - mov [esp+68],00000005
Warframe.exe+2F38C8 - E8 E3F2FFFF - call Warframe.exe+2F2BB0
Warframe.exe+2F38CD - 83 C4 10 - add esp,10
Warframe.exe+2F38D0 - E9 2AFEFFFF - jmp Warframe.exe+2F36FF
Warframe.exe+2F38D5 - 8B 54 24 0C - mov edx,[esp+0C]
Warframe.exe+2F38D9 - 8B C7 - mov eax,edi
Warframe.exe+2F38DB - C1 E8 0E - shr eax,0E
Warframe.exe+2F38DE - 89 53 18 - mov [ebx+18],edx
Warframe.exe+2F38E1 - A9 00010000 - test eax,00000100
Warframe.exe+2F38E6 - 74 0E - je Warframe.exe+2F38F6
Warframe.exe+2F38E8 - 8B 4C 24 1C - mov ecx,[esp+1C]
Warframe.exe+2F38EC - 25 FF000000 - and eax,000000FF
Warframe.exe+2F38F1 - 8D 04 C1 - lea eax,[ecx+eax*8]
Warframe.exe+2F38F4 - EB 0C - jmp Warframe.exe+2F3902
Warframe.exe+2F38F6 - 8B 54 24 10 - mov edx,[esp+10]
Warframe.exe+2F38FA - 25 FF010000 - and eax,000001FF
Warframe.exe+2F38FF - 8D 04 C2 - lea eax,[edx+eax*8]
Warframe.exe+2F3902 - 56 - push esi
Warframe.exe+2F3903 - 50 - push eax
Warframe.exe+2F3904 - 8B 44 24 18 - mov eax,[esp+18]
Warframe.exe+2F3908 - C1 EF 17 - shr edi,17
Warframe.exe+2F390B - 8D 0C F8 - lea ecx,[eax+edi*8]
Warframe.exe+2F390E - 51 - push ecx
Warframe.exe+2F390F - 53 - push ebx
Warframe.exe+2F3910 - E8 9BF2FFFF - call Warframe.exe+2F2BB0
Warframe.exe+2F3915 - 8B 53 0C - mov edx,[ebx+0C]
Warframe.exe+2F3918 - 83 C4 10 - add esp,10
Warframe.exe+2F391B - 89 54 24 10 - mov [esp+10],edx
Warframe.exe+2F391F - E9 E2FDFFFF - jmp Warframe.exe+2F3706
Warframe.exe+2F3924 - 8B 44 24 24 - mov eax,[esp+24]
Warframe.exe+2F3928 - 8B 48 0C - mov ecx,[eax+0C]
Warframe.exe+2F392B - 8B 44 24 1C - mov eax,[esp+1C]
Warframe.exe+2F392F - 8B 54 24 0C - mov edx,[esp+0C]
Warframe.exe+2F3933 - 89 4C 24 6C - mov [esp+6C],ecx
Warframe.exe+2F3937 - 56 - push esi
Warframe.exe+2F3938 - C1 EF 0E - shr edi,0E
Warframe.exe+2F393B - 8D 0C F8 - lea ecx,[eax+edi*8]
Warframe.exe+2F393E - 89 53 18 - mov [ebx+18],edx
Warframe.exe+2F3941 - 51 - push ecx
Warframe.exe+2F3942 - 8D 54 24 74 - lea edx,[esp+74]
Warframe.exe+2F3946 - 52 - push edx
Warframe.exe+2F3947 - 53 - push ebx
Warframe.exe+2F3948 - C7 84 24 80000000 05000000 - mov [esp+00000080],00000005
Warframe.exe+2F3953 - E8 98F3FFFF - call Warframe.exe+2F2CF0
Warframe.exe+2F3958 - 8B 43 0C - mov eax,[ebx+0C]
Warframe.exe+2F395B - 83 C4 10 - add esp,10
Warframe.exe+2F395E - 89 44 24 10 - mov [esp+10],eax
Warframe.exe+2F3962 - E9 9FFDFFFF - jmp Warframe.exe+2F3706
Warframe.exe+2F3967 - 8B 4C 24 24 - mov ecx,[esp+24]
Warframe.exe+2F396B - 8B 16 - mov edx,[esi]
Warframe.exe+2F396D - C1 EF 17 - shr edi,17
Warframe.exe+2F3970 - 8B 7C B9 14 - mov edi,[ecx+edi*4+14]
Warframe.exe+2F3974 - 8B 47 08 - mov eax,[edi+08]
Warframe.exe+2F3977 - 89 10 - mov [eax],edx // <~~~~~~~~~~~~ !!
Warframe.exe+2F3979 - 8B 4E 04 - mov ecx,[esi+04]
Warframe.exe+2F397C - 89 48 04 - mov [eax+04],ecx
Warframe.exe+2F397F - 83 7E 04 04 - cmp dword ptr [esi+04],04
Warframe.exe+2F3983 - 0F8C 7DFDFFFF - jl Warframe.exe+2F3706
Warframe.exe+2F3989 - 8B 36 - mov esi,[esi]
Warframe.exe+2F398B - F6 46 05 03 - test byte ptr [esi+05],03
Warframe.exe+2F398F - 0F84 71FDFFFF - je Warframe.exe+2F3706
Warframe.exe+2F3995 - F6 47 05 04 - test byte ptr [edi+05],04
Warframe.exe+2F3999 - 0F84 67FDFFFF - je Warframe.exe+2F3706
Warframe.exe+2F399F - 56 - push esi
Warframe.exe+2F39A0 - 57 - push edi
Warframe.exe+2F39A1 - 53 - push ebx
Warframe.exe+2F39A2 - E8 D9ECFFFF - call Warframe.exe+2F2680
Warframe.exe+2F39A7 - 83 C4 0C - add esp,0C
Warframe.exe+2F39AA - E9 57FDFFFF - jmp Warframe.exe+2F3706
I got the hack work like this: every color that i can choose from "CLASSIC" is able to choose from other color pack.
Therefore at my test account i can only choose color from column 3 of every color pack
that's it. 
Originally Posted by whitegun
