I am doing reverse engineering of a binary firmware image of unknown provenance, which operates on a device that is not physically accessible to me. That is, I can't take apart the device, don't have even block diagrams for its function, and have no ability to identify the microprocessor by visual inspection or by asking the creator of the object. Literally the only thing available is the binary image.
My question is: given those constraints what tools or theoretical approaches could be employed to identify the processor's instruction set by examining the binary?
Research so far:
I have, of course, attempted to use disassemblers for various popular ISAs such as ARM, x86 and MIPS. I have also done a literature search for research papers but haven't turned up anything at all.
Ideally, what I'd like is a tool that would examine the binary and then report something like "75% probability that this is code for a Renesas M16C."