I remember SourcePawn! It was a bit too hardcore for me at the time. If I remember correctly it used a thing called 'sigscanning'[1] to find the address of private functions. I think it would have a list of patterns and then scan the binary w/ pattern matching to find the address.
Hacky as hell but you could do some neat stuff with it like respawning players and adjusting all kinds of 'untouchable' attributes.
1. https://wiki.alliedmods.net/Signature_Scanning