Okay.. you found the maparea. The first 40000 bytes (and a little) are mapdata (Trees, Mountains etc.) we don't need to change that.
Now, take the maparea address (your xxxxx20) and add 40814 (windows calculator, HEX).
This is the point (address) where a second map (for collisions) begins. It stores where you can walk and where not. Finish line would be to clear that map with zeros (=walk everywhere).
If you use cheatengine you may do it with a LUA script like:
PHP Code:
function WallhackClick(sender)
start=memoryrecord_getValue(addresslist_getMemoryRecordByDescription(getAddressList(), "Wallhack Base"))+0x40814
for i=0,0x3ffff,4 do
writeBytes(start+i,0)
end
end