Code:
/*0x2002000 in RAM - 0x6000 in ROM (0x2000 in ARM9.bin)*/
stmdb r13!,{r0-r1}
ldr r1,CharAddr
ldrb r0,[r1]
cmp r0,#0x0;@change to value of character to replace
moveq r0,#0xc
streqb r0,[r1];@shy guy
moveq r0,#0x24
streqb r0,[r1,#+0x4];@shy guy's cart
ldmia r13!,{r0,r1}
bx r14
CharAddr: .long 0x23cdd40
Code:
/*0x2003208 in RAM - 0x7208 in ROM (0x3208 in ARM9.bin)*/
b 0x2002000;@7C FB FF EA in little endian bytecode
If you can't or don't want to reassemble the code then just alter the value at 0x16 to change which character gets replaced by Shy Guy.
Here's the patch and source.