The name that becomes a Pokémon

Every species has a two-byte pointer in this table, indexed by (species − 1) × 2, into its own evolution-and-move-learn data. For the 190 real species in the game this is a completely ordinary lookup. Nothing checks that species is one of those 190 before doing the arithmetic.

Feed the lookup a species index above 190 and the pointer it computes lands somewhere else in bank 0E — not a crash, just a different address, holding whatever bytes were already there. Evolution_PartyMonLoop reads that address as a stream of evolution-table entries anyway: a byte for the entry type, then whatever that type's format calls for. Most of the stream decodes as entries with no real meaning and gets skipped; sooner or later — sometimes never, sometimes after dozens of skipped "entries" — the parser hits a byte pattern that happens to look like a valid LEVEL entry, and evolves the Pokémon into whatever species byte follows it.

The bytes past the table's real end are ordinary ROM bytes — code and data belonging to whatever else lives in that bank. They never change between runs. Every out-of-range species index has exactly one predicted outcome, and it can be worked out in advance by walking the same bytes the real CPU would read, without ever running the game.

Viridian City's Old Man runs a scripted catching demonstration through the same battle-menu routine every other battle uses. For that one battle type, the routine copies the player's own 11-byte name into wLinkEnemyTrainerName — which the game's own memory layout overlaps with wGrassRate and the 20-byte wGrassMons wild-encounter table. Loading a new map is supposed to overwrite that table with real data, but a town with zero wild encounters skips the overwrite entirely — it only ever clears the rate byte. Cinnabar Island and Route 21 are exactly that kind of map, so the table keeps whatever the Old Man's demo last wrote into it: the player's name.

A wild encounter rolls its odds against one tile check and reads its species data from a second, independent tile check. On a "left shore" half-block — the game's own disassembly names Cinnabar Island's east coast as the example — those two checks disagree: the odds are rolled as a water tile, but the species comes from the grass table. So a wild encounter on that one tile reads species data out of a table that, on Cinnabar or Route 21, still holds the player's own name.

The 11-byte copy lands as five (level, species) pairs. The first pair — the most heavily weighted encounter slot — takes its species byte from the trainer name's 3rd character. Gen 1's text encoding maps the digits 0–9 directly onto internal species indices 246–255. A name with a digit in that position is a direct, deliberate choice of which out-of-range species shows up in the grass.

The name copy itself was run on the real CPU at the exact instruction (bank 0F:$4EDD): a name with '6' as its 3rd character produced species byte $FC (252) in the wild-encounter table after 82 real instructions, byte for byte. Walking the evolution table for each of the ten name-reachable indices and then running the real evolution routine on the two most interesting of them confirmed both: species 252 evolves into SLOWPOKE after 317 real instructions, and species 255 evolves into GROWLITHE after 461 — both landing exactly where the static walk of the real ROM bytes predicted.

AddEnemyMonToPlayerParty copies a traded-in Pokémon's species byte from whatever the other console sent — the link-cable protocol is unencrypted and has been reverse-engineered end to end, so a real, buildable modified device can offer any byte it likes. Nothing on the receiving side validates it against the real species list before writing it into the party.

Two complete TerminalGB cores were joined over the project's own real link cable implementation and driven through an actual Cable Club trade — walk to the receptionist, take the link menu, select the party slot, confirm — with one side offering a hand-built Pokémon carrying species byte 0xC1 (193). Reading the receiving console's live memory straight after "Trade completed!" confirmed the byte survived the real wire intact: species 193, level 8, exactly as sent.

The game forces an evolution check on the traded-in Pokémon immediately, as part of the trade animation, before "Trade completed!" even prints. But at that exact instant the game's own link-state flag still reads LINK_STATE_TRADING, and the evolution parser skips any entry that isn't a same-instant trade evolution while that flag is set. Species 193's table entry is the ordinary LEVEL kind, not a trade evolution, so the mid-trade check waves it through untouched. The forced flag survives the trade and takes effect for real at the next battle the receiving player wins — by which point the link-state flag has been cleared, and nothing stops the evolution any more. The traded-in Pokémon looks completely ordinary in its new owner's party until then.

After the trade, the receiving console fought seven real wild battles with the traded-in Pokémon, over real game frames rather than scripted turns. On the seventh, the moment its level crossed the table's own predicted threshold, the game printed "SPECOP evolved into SPEAROW!" — matching, byte for byte, both the species the static table walk predicted for 193 and the exact level it predicted the evolution would require. The party structure's own species byte read 0x05 immediately after, confirming the on-screen text against a direct memory read of the same event.