this is the hooking of CSSFinal( will work for dods,tf2,l4d,l4d2 ) same method apply

First off search for "STEAMREMOTESTORAGE_INTERFACE_VERSION002" in client.dll.
then scroll down until u see this line:

$-20     > F64424 04 01     TEST BYTE PTR SS:[ESP+4],1
$-1B     > 56               PUSH ESI
$-1A     > 8BF1             MOV ESI,ECX
$-18     > C706 80703916    MOV DWORD PTR DS:[ESI],client.16397080
$-12     > 74 09            JE SHORT client.1607B739
$-10     > 56               PUSH ESI
$-F      > E8 CA8B0600      CALL client.160E4300
$-A      > 83C4 04          ADD ESP,4
$-7      > 8BC6             MOV EAX,ESI
$-5      > 5E               POP ESI
$-4      > C2 0400          RETN 4
$-1      > CC               INT3
$ ==>    > 83EC 08          SUB ESP,8 <- here!!!!
$+3      > E8 48F60500      CALL client.160DAD90
$+8      > D9EE             FLDZ

then right-click -> view -> relative address on "SUB ESP,8"

then search for this line:

$+2D6    > 68 B4733916      PUSH client.163973B4                     ; ASCII "ServerUploadGameStats001"
$+2DB    > FF5424 14        CALL DWORD PTR SS:[ESP+14]
$+2DF    > 83C4 08          ADD ESP,8
$+2E2    > 85C0             TEST EAX,EAX
$+2E4    > A3 24AC4D16      MOV DWORD PTR DS:[164DAC24],EAX
$+2E9    >^0F84 9DFDFFFF    JE client.1607B7CC
$+2EF    > 833D E89A5216 00 CMP DWORD PTR DS:[16529AE8],0
$+2F6    >^0F84 90FDFFFF    JE client.1607B7CC
$+2FC    > 8B4C24 0C        MOV ECX,DWORD PTR SS:[ESP+C]
$+300    > 57               PUSH EDI
$+301    > 8B7C24 14        MOV EDI,DWORD PTR SS:[ESP+14]
$+305    > 8D5424 04        LEA EDX,DWORD PTR SS:[ESP+4]
$+309    > 52               PUSH EDX
$+30A    > 894C24 08        MOV DWORD PTR SS:[ESP+8],ECX
$+30E    > 897C24 0C        MOV DWORD PTR SS:[ESP+C],EDI
$+312    > E8 D9480000      CALL client.16080330 <- here!!!!

so DWORD dwFactoryList_Store = dwInit + 0x312; :)

then stepinto CALL Client.16080330.
which should take u to this:

$ ==>    > 8B4424 04        MOV EAX,DWORD PTR SS:[ESP+4]
$+4      > 8B08             MOV ECX,DWORD PTR DS:[EAX]
$+6      > 8B50 04          MOV EDX,DWORD PTR DS:[EAX+4]
$+9      > 890D 40B34D16    MOV DWORD PTR DS:[164DB340],ECX
$+F      > 8915 44B34D16    MOV DWORD PTR DS:[164DB344],EDX
$+15     > C3               RETN

then do the same again right click on "MOV EAX,DWORD PTR SS:[ESP+4]" view -> relative address.

so then we do dwFactoryList_Store +=  *(DWORD*)( dwFactoryList_Store + 0x1 ) + 0x5;//( 0x4+1byte )

then we need to find a pointer to appsystem interface or we will crash.

so right click on "MOV ECX,DWORD PTR DS:[EAX]"

$ ==>    > 8B08             MOV ECX,DWORD PTR DS:[EAX]
$+2      > 8B50 04          MOV EDX,DWORD PTR DS:[EAX+4]
$+5      > 890D 40B34D16    MOV DWORD PTR DS:[164DB340],ECX
$+B      > 8915 44B34D16    MOV DWORD PTR DS:[164DB344],EDX//HERE!
$+11     > C3               RETN

ok as u can see its + 0xB so all we need to do now is:

m_Factories[ INTERFACE_APPSYSTEM ] = (CreateInterfaceFn)**(DWORD**)( dwFactoryList_Store + 0xB );

and thats about it :)

DODS:

DWORD dwFactoryList_Store = dwInit + 0xBAD;

rest is the same