Total Key Remap

How to apply any mapping of keyboard or mouse keys to actions in HZD by hacking profile.dat

Introduction

This guide is for those players who prefer a more exotic key mapping than HZD's keymap options allow. As an example, I am old-school and like to have the movement on the mouse buttons, while firing and aiming is near the left control key. While HZD allows moderate remapping, it reveals its origins of the game console world by not allowing obvious PC keys, such as extended mouse buttons or higher function buttons (F11, F12). A huge annoyance that can be seen in many comments is the tool wheel -- wouldn't it be nice to scroll through the tools with the mouse wheel and select weapon slots with 1/2/3/4?

udev Remapping

I am using Linux and the Proton compatibility layer. One option to remap is at the operating system-level. A specific device (e.g., a mouse with USB ID 046d:c539) can be remapped with the udev system, specifically, files in /etc/udev/hwdb.d/. I managed to remap one of the MMO buttons to F10 and use it as secondary roll. My roll/dodge success increased dramatically. I assume that the usual Windows-only software that comes with gaming mice and keyboards can fulfill similar functions. However, while this method is flexible and straightforward, it it still limited to supported buttons and is not the core of this guide.

Instead, let us take a look at the configuration file.

Hacking the file 'profile.dat'

Game settings, including key assignments are stored in a binary file 'profile.dat', found at

$HOME/SteamLibrary/steamapps/compatdata/1151640/pfx/drive_c/users/steamuser/Documents/Horizon\ Zero\ Dawn/Saved\ Game/profile/

and for Windows users probably in a similar location that starts with C:\ instead of drive_c/.

Since this is a binary file, a hex editor will be needed. If you don't know what a hex editor is, this guide may not be for you. Also, I need to point out that hacking profile.dat carries the risk of bombing your configuration. Make backup copies. If all else fails, purge the configuration and start over.

There are many hex editors available. Midnight commander is one option (Windows: Total Commander, Free Commander -- no guarantee, I do not have Windows at all). The point is that you need to be able to examine and change the value of arbitrary bytes in a binary file.

The configuration file, profile.dat, contains key mappings for US and French keyboard layouts, and for PS4, Xbox, and the Steam Controller. Each of them occupies its own section in profile.dat. In addition, a sort of table of contents starts at offset 0x006491 (actually, the contents as null-terminated strings). Other settings are found in this file, too, but more work is needed to find the individual locations. Two examples are the byte at offset 0x0057D (aim assist: byte value 01 'on', and byte value 00 'off'), and offset 0x00710 (game difficulty, e.g., 01 = easy; 03 = hard). Perhaps it would be possible to ... ahem ... unlock the locked Game+ difficulty?

The US keymap section starts at byte offset 0x0071D and ends at 0x00C99, after which follows the French-layout keymap section.

US Keyboard keymap structure

Each key map entry consists of 26 bytes. The 26-byte length is consistent for the US keyboard, but 27-byte long entries exist for the other layouts; the console mappings are interspersed with other byte streams of unknown significance.

Each key map entry begins with a 32-bit integer (first four bytes) that is likely the action index (which matches across keyboard and controller mappings), followed by a short int (16 bits) of what appears to be flags, followed by the int32 constant 0x000000003. The next two int32 are the key codes for the primary and for the secondary key assignment, and two int32 values follow that are always (-1), 0xffffffff.

For example, the entry for "use medicine pouch" is at offset 0x00959 and contains the bytes

00959: 07 12 00 00    Action 1810 decimal
0095D: 00 00          Flags
0095F: 00 00 00 03    int32 constant of 3
00963: 7F 00 00 00    Primary assignment, key 7F (Function key F5)
00967: 5F 00 00 00    Secondary assignment, key 5F (numpad +)
0096B: FF FF FF FF    Constant -1
0096F: FF FF FF FF    Constant -1

The complete list of keymap entries:

Offset (hex)	Action code (decimal)	Flags (if not 00)	Function
0071D	1813		Move forward
00737	1814		Move backward
00751	1815		Move left
0076B	1816		Move right
00785	1817		Toggle walk/run
0079F	1792		Sprint
007B9	1793		Interact
007D3	1794		Roll
007ED	1795		Crouch
00807	1842		Jump
00821	1797		Toggle focus
0083B	1798		Show HUD
00855	1801	(02)	Light melee
0086F	1818	(01)	Heavy melee
00889	1803	(06)	Aim
008A3	1804	(03)	Fire
008BD	1805	[03]	Reload
008D7	1846	[03]	Concentration
008F1	1806	(01)	Weapon wheel
0090B	1807		Interact 2 (F)
00925	1808		Cycle tool left
0093F	1809		Cycle tool right
00959	1810		Use med pouch
00973	1819		Weapon slot 1
0098D	1820		Weapon slot 2
009A7	1821		Weapon slot 3
009C1	1822		Weapon slot 4
009DB	1823	(08)	Skills
009F5	1824	(08)	Inventory
00A0F	1825	(08)	Craft
00A29	1826	(08)	Map
00A42	1827	(08)	Quests
00A5D	1828	(08)	Notebook
00A77	1834		Manual save
00A91	1835	(04)	Tag
00AAB	1836	(06)	Turn page left
00AC5	1837	(06)	Turn page right
00ADF	1838	(05)	Menu take all
00AF9	1839	(05)	Menu function group 1 (R)
00B13	1840	(05)	Menu function group 2 (G)
00B2D	1841	(05)	Menu function group 3 (F)
00B47	1832	(07)	Turn holo left
00B61	1833	(07)	Turn holo right
00B7B	1812		Unknown action assigned to left mouse button
00B95	1811		Unknown action assigned to left mouse button
00BAF	1802		Unknown action assigned to left mouse button
00BC9	1822		Focus toggle
00BE3	1830		Interact
00C07	1831		Unknown action assigned to CapsLock
00C17	1844		Default action, scroll wheel up
00C31	1845		Default action, scroll wheel down
00C4B	1799		Non-remappable action for ENTER key
00C65	1800		Non-remappable action for ESC key
00C7F	1843		Non-remappable action for space bar

The non-remappable functions toward the end, such as action codes 1802, 1811, and 1812 may well be functions in different contexts, such as left-click on the map or menu.

To remap any primary action, modify the four (!) bytes at the offset given in the table plus 0x0a (where the 32-bit integer for the primary action resides), and to remap any secondary action, the four bytes beginning at offset + 0x0e would be modified.

And modify to what? We need to take a look at the HZD-internal key codes.

Keyboard and Mouse Button Codes

Each key and mouse button has a unique code. Some have not yet been determined, The known codes are:

Keyboard Key	Key code(s)
A...Z keys	0x91 though 0xAA
0...9 number keys	0x87 through 0x90
Numpad 0...9 keys	0x62 through 0x6B
Function keys Fn1 through Fn10	0x7B through 0x84
Arrow keys L/R/U/D	0x53 through 0x56
ESC	0x43
TAB	0x52
ENTER	0x50
SPACE	0x46
lAlt	0x72
lCtrl	0x74
lShift	0x76
CapsLock	0x6D
Mouse Button	Key code
Left mouse button (MB1)	0xBB
Right mouse button (MB2)	0xBC
Middle mouse button (MB3)	0xBD
Side mouse button 4 (MB4)	0xBE
Side mouse button 5 (MB5)	0xBF
Mouse scroll wheel up	0xC0
Mouse scroll wheel down	0xC1

Thus equipped, it may be time for an example...

Example: Using the scroll wheel for the tool selection

'R' and 'T' keys to scroll through a dozen tools? In the heat of combat? Really??

Let's remap this. The scroll wheel function is fixed and cannot be edited from within HZD. The assigned function is to select the weapon slot, which is pointless, because (unlike the keys 1 through 4) it can't select the weapon function. A prime candidate for remapping, I'd submit.

The keymap entries for 'Cycle Tool Left' and 'Cycle Tool Right' (action codes 1808 and 1809) are found at offset 0x00925 and 0x0093F, respectively. We can leave their primary assignment as R and T and use the secondary assignment. Initially, these locations (four bytes starting at 0x00933 and 0x0094D) are 0xFFFF FFFF, meaning, not assigned.

The scroll wheel has the codes 0xC0 (up) and 0xC1 (down). Exit the game so that the config file does not get overwritten. Edit profile.dat with the hex editor: Go to location 0x00933 and replace

00933: FF FF FF FF
with
00933: C0 00 00 00.

Next replace

0094D: FF FF FF FF
with
0094D: C1 00 00 00.

Although this modification works as-is, it is recommendable to cancel the original scroll wheel function. At offset 0x00C21, replace 0xC0 with 0XC2, and at offset 0x00C3B, replace 0xC1 with 0xC3 -- the key codes C2 and C3 not belonging to any key.

[Theynvelt]

Thanks, E>|<OHOK, for the kind words. It has been a while, and it may take me a few days to look into your specific remapping idea. I am confident that it is possible: You are specifically looking for map scrolling, correct? I am asking, because, as you surmised, each "WASD" has a specific function in one of the menus.

[Ostrogin]

This is genius!

Thank you very much!) It really helped me and boosted my ingame immersion, skills and overall experience multiple times!

I can't seem to find the scroll map up/down/left/right offsets anywhere. Found a couple of entries where the default W,S,A,D keys are present right next to each other, but changing those doesn't seem to work. If you know, please let me know. I use E,D,S,F for movement and would like to remap the scroll map defaults to E,D,S,F too.

Your solution is the best that I have found! Great work! Thank you!

[Theynvelt]

Stella, let me try an educated guess. The profile.dat file contains separate records for US and French, not DE, though. I know what keys are on the US keyboard where you have the mutated vowels, and these keycodes are known (; and ' and [ )... aka ain't gonna work -- at least not in a straightforward manner. I assume that whoever committed this atrocity of a PC port didn't consider your layout.

Never the less, these keys have a defined keycode, so they should be remappable. Trial-and-error? Yes, but with some good guesses. For example, I expect (never tried it, though) that F11 and F12 are 0x85 and 0x86 (note the gap between F10 (0x84) and '0' (0x87)). My first target would be the gap between Z (0xAA) and LMB (0xBB).

This is probably less work than it sounds, because you can modify several functions between game restarts. Again, make a copy of your unspoiled profile.dat before you begin.

Let me know if you find something out, I'd be happy to include it.

[Stella]

Hey, L equis here from the Horizon Zero Dawn fandom. I've looked through the instructions and i think they're really good, I've yet to try this myself though. I like that you gave an example for remapping to the scroll wheel.

I've got a question, would you know what the keyboard codes would be for ä, ö, and ü ? I'd like to assign inventory, map, etc to these buttons, like I do in every game, but they're not in your list of assignable buttons