Health is within the object you are looking at. Its always
Code:
MOV EAX, DWORD PTR [Obj_Base]
MOV EAX, DWORD PTR [EAX+Offset]
in C
Code:
u_int *health = *((PDWORD)Obj_Base + Offset);
Easiest way to get find these objects is to find the address of g_clientConnection get its value and add the offset. That should give you the ObjManager then you can parse through the linked list and get the info you need.
Code:
MOV EAX, DWORD PTR [g_clientConnection]
MOV EAX, DWORD PTR [EAX+ 0x2864]
Thats as much of it as I understand. If I stated something wrong please correct me.