Freescale Coldfire V4s

[Fats]

There is no way to tell which part of the binary is code and which data. If you translate data in similar manner you'll just corrupt it.

What you do know is that the program entry is code. You can start from there and put traps in sections where you are not sure (e.g jmp tables etc.). You could combine it with a cache that remembers translated code.
In a later stage you can make tools that makes binary patches from this cache so this information can be distributed or updated so that the loader doesn't need to find out each time it loads a program.
Non-trivial job, I agree, but what would we hobby programmers do otherwise ?

greets,
Staf.

[Fats]

No, it still won't work. This doesn't account for code that dynamically jumps into various parts of code or performs run-time modifications to the code. Static analysis cannot account for these.

For run-time modification I agree, dynamically jmp should be able to be trapped by adding trap code like a debugger does.

greets,
Staf.