Arbitrary Code Execution: Reprogramming Pokemon From Inside the Game
A 1996 Game Boy cartridge hides a programmable computer. You do not need a single wire, chip, or hack. You need the right items, in the right order, and one instruction the developers forgot to guard.
The animation above is not decoration. It is the exploit. A player opens the bag, scrolls to an item that should not exist, an item the community calls 8F, and presses USE. The screen tears itself apart, and out of the wreckage the game spells three words it was never programmed to say. That is arbitrary code execution, and by the end of this page you will know exactly which instruction let it happen, because we read it out of the ROM.
It comes down to one instruction
When you select an item and choose USE, the game has to decide what that item does. It looks up the item's function in a table of pointers, one entry per item, and jumps to whatever address it finds. Here is that decision, exactly as it lives in the ROM:
Look at what is checked and what is not. The game asks a single question: is this item a TM or an HM? If it is, it branches away. If it is not, it trusts the ID completely. It never asks whether the ID belongs to a real item. It multiplies the ID by two, walks that many bytes into the pointer table, reads whatever two bytes are sitting there, and runs jp hl, a jump to that address.
A normal item lands on a real, safe function. The item called 8F sits far past the end of the real table, so the game reads two bytes from unrelated memory and jumps to whatever number they spell. If you can control that memory, you control where the game jumps. And you can.
Your bag becomes the program
The trick that turns this from a crash into a computer is that the memory the game jumps into is memory you can arrange. The classic route lands execution inside the item bag itself. To the game, an item is a pair of bytes: which item, and how many. To a processor, those exact same bytes are instructions. So a carefully built bag, item by item and quantity by quantity, is not a list of things. It is a list of commands.
Real Gen 1 item IDs, real Game Boy opcodes. A two-byte "load" item like Lemonade ($3E = LD A) turns its quantity into the number it loads: hold 66 Lemonades and the CPU reads LD A, 66. Change a quantity and watch the instruction change. Hover a row to see the two readings of the same bytes. (Storing and jumping need glitch items too; this shows the duality, not a full exploit.)
Arrange the right items in the right amounts and the bag stops being inventory. It becomes a short program that can copy a longer program in from somewhere roomier, a box name, the player's name, stored text, and hand control to it. From there the game will do anything the Game Boy can do, including drawing whatever it likes to the screen. The three words in the animation above are written the same way: not by the game's code, but by yours.
Speedrunning: the record collapses
Beaten fair, Pokemon Red takes about three hours. Allow the small glitches every runner uses and it falls under two. Then arbitrary code execution changed the question entirely. By writing straight to memory and jumping to the ending, runners stopped playing the game and started reprogramming it mid-run. The record for beating Pokemon Red is now well under two minutes. Ride along and watch it fall.
That last number is not a typo. In the fastest category the game is barely played at all: the run sets up a bag, uses a glitch item, and the code it runs writes the ending directly into memory. The clock stops before most people finish the opening cutscene.
What people have actually built
Once you can run your own code, the game stops having rules. Documented feats, developed over years by a large community of players and researchers, include spawning any Pokemon at any level, writing directly into the Hall of Fame, warping anywhere, rewriting the save, and loading entire custom programs so the cartridge plays sound or renders graphics it never shipped with. The exploit is the door. What people walk through it with keeps growing. Pick one and run a little homage on the screen below.
But how do you get an impossible item?
8F is not on any shelf. You reach it through an item underflow: the bag keeps a count of how many items it holds, and a marker for where the list ends. Corrupt either one and the list runs off its end, reading the memory that comes after it as if those bytes were items. Step through it.
Does it still work
The instruction that makes it possible ships inside the ROM, so it goes wherever the ROM goes. Pick a way to play and check.
Made from the source
Every letter, sprite, and byte on this page was read out of a Pokemon Red ROM, nothing captured from a screen. To prove it: here is a single character from the game's font, as raw cartridge bytes. Watch it decode into pixels, one bit at a time, exactly the way the Game Boy does it.
Go deeper: the Gen 1 battle engine | browse the Glitchhouse | the Name Glitch calculator.