Everything is injected. Even most of Pokémon Gold, including the code enabling GBC features (the font is the same tho). This can't be done on the NES because the character (graphics) is in CPU-inaccessible memory (and therefore ROM on most cartridges). There are several stages of the payload that write and execute each other:

name+item manipulation
- a few bytes in several seconds
copying existing button input buffer
- 60 bytes per second
polling buttons in a loop
- only CPU-constrained, almost as fast as copying from the cartridge to RAM, literally fast enough to stream video

[–] akunohana@piefed.blahaj.zone 1 points 9 hours ago

What have you done. I saw your comment the moment I entered my flat. I shouldn't have pressed the link (pun intended). But I did.

I didn't change, shower, eat or any other of my coming home on a workday routines. I just watched. And cried at the end.

My childhood, after 37 years, is now complete. Thank you 🫶