Software is often distributed in environments that are not controlled by its developers. Once a program runs on a machine controlled by a potential attacker, it can be inspected, modified, and executed under different conditions. For this reason, software protections against reverse engineering are not usually expected to prevent attacks completely. Their goal is rather to increase the amount of work needed to understand or bypass the protected program. Evaluating whether a protection achieves this goal is not straightforward. Software metrics can describe some properties of a protected program, but they do not directly measure the effort required by a concrete attack.