The height is stored as a float value in a CGPlayer_C object. I find the offset by looking at the function: int __stdcall sub_500B20(float), which uses the character height. The exact call used to get the height is:
Code:
.text:00500D23 fld dword ptr [ebx+854h]
Where ebx contains the memory location of the CGPlayer_C object and 854h is the offset to the model height.
You can find the offset by using the follow pattern in CFindPattern:
Code:
<Pattern desc="PlayerModelHeightOffset" pattern="\x??\x??\x00\x00\xD8\x0D\x??\x??\x??\x00\xD8\x46\x??\xD8\x45\x??\xE9\x??\x??\x??\x??\xD9\x46\x??\xD8\x4E\x??\xD8\x4D\x??\xD8\x6E\x??\xD9\x56\x??\xD9\x05\x??\x??\x??\x00\xD8\x??\xDF\xE0" mask="??xxxx???xxx?xx?x????xx?xx?xx?xx?xx?xx???x??xx">
<Lea />
</Pattern>