Software Security Impossible in Non-Trusted Hardware?
Recently, ECRYPT CSA organized a white-box challenge where you can publish your white-box implementation for AES-128 without exposing your design and the chosen key.

As a result, all the submitted challenges have been broken in less than one month, which further proves that "obscurity" is never sufficient to protect your assets. 

To the best of my knowledge, there are no formal methods to measure the obscurity strength achieved in a software.