CA Player Structs

How do you reverse engineer Cshell do get the enemy pointer in CA? I want to make Box ESP.

You can use some Lithtech SDK. With it you can know easier where the classes are located inside the DLL's disassembled code (dead listing).