@Darksoft "change the type of some variables so now they show text where should be a number"
pretty much this.
If you are not familiar with format strings, here is how they work. In essence a number of functions accept 'format specifiers', printf() being one we can use for an example. They help format how the resulting text is displayed to the screen, one such function is likely being used by Naomi Test menu, and the DIMM firmware that I was modifying. The developer was accepting the specifier in what is in essence user controlled input for lack of better term.
usually proper practice would dictate that the developer specify the format string on their own, rather than ingesting it from untrusted input vectors. As a result an "attacker" can supply their own format specifier if they can control the input, as you can in this specific case (because the rom is editable).
Common format specifiers are:
%s for string
s
If no l modifier is present: The const char * argument is expected to be a pointer to an array of character type (pointer to a string). Characters from the array are written up to (but not including) a terminating null byte ('\0'); if a precision is specified, no more than the number specified are written. If a precision is given, no null byte need be present; if the precision is not specified, or is greater than the size of the array, the array must contain a terminating null byte.
%x for unsigned hex
o, u, x, X
The unsigned int argument is converted to unsigned octal (o), unsigned decimal (u), or unsigned hexadecimal (x and X) notation. The letters abcdef are used for x conversions; the letters ABCDEFare used for X conversions. The precision, if any, gives the minimum number of digits that must appear; if the converted value requires fewer digits, it is padded on the left with zeros. The default precision is 1. When 0 is printed with an explicit precision 0, the output is empty.
More detail on the exact specifiers available can be found here:
https://linux.die.net/man/3/printf
There is a very special specifier called %n, in which you can rather than *read* memory, you can *write* to it.
n
The number of characters written so far is stored into the integer indicated by the int * (or variant) pointer argument. No argument is converted.
Being able to write to memory actually allows you to influence process control. You can ultimately get to a point in which you can control the address being referenced by the format specifier, and as such you end up with a "what / where" constant in which you can write any bytes you want anywhere in memory. There are of course nuances and techniques to make this happen in certain contexts.
These are some examples of exploitation of format strings issues to provide root on an OSX machine. I wrote the detail many many years ago! Over a decade at this point.
http://www.digitalmunition.com/DMA[2006-0628a].txt
https://www.exploit-db.com/papers/13179/
"It would be helpful for some people debugging that wanted to show some text on the screen"
yes at this point probably not much use to you folks, but years ago before all the memory locations were known, and details on the memory layout of the system this could indeed have been used to debug certain aspects of the system.
In theory, this could very likely be used to modify the memory of a NetDIMM, to massage bits of the OS in place to allow login to the underlying vxworks OS. Again... probably not of much use, but fun for folks that enjoy mental gymnastics.