How about undocumented instructions? Sandsifter[1] is an interesting project and the video from BlackHat[2] is a good watch. There's also a previous discussion of it on HN[3].

[1] https://github.com/Battelle/sandsifter

[2] https://www.youtube.com/watch?v=KrksBdWcZgQ

[3] https://news.ycombinator.com/item?id=18179212