I'd compare the frequency (count for each value in the file) of instructions with the frequency of instructions derived from files for known processor types. That isn't necessarily what your target wants to see, however. Sometimes they're encrypted and signed, sometimes plain text. It might be a simple file, or something complex that is more