A computer-implemented method of generating a protected software application using white-box cryptography, comprising: receiving at least one input source file including application source code and abstracted white-box function calls; receiving a parameterization file containing one or more parameterization records each of which corresponds to an abstracted white-box function call and includes cryptographic domain parameters for that abstracted white-box function call; generating white-box call definition data mapping each abstracted white-box function call to one or more routines in a white-box library based at least in part on the cryptographic domain parameters corresponding to that abstracted white-box function call, wherein generating the white-box call definition data comprises generating a white-box call definition file and white-box metadata specifying parameters chosen for each abstracted white-box function call; applying at least one data transformation to the input source file and the white-box call definition data to respectively generate a transformed source file and transformed white-box call definition data, wherein applying the at least one data transformation to the white-box call definition data generates a transformed white-box call definition file and transformation metadata specifying data transformations chosen for selected parameters; generating data initializations encapsulating the instance-specific data for each white-box function call based on the white-box call definition data and the transformed white-box call definition data; and compiling the transformed source file, the transformed white-box call definition data and the data initializations, and linking the resulting compiled code against the white-box library to provide an executable software application. receiving at least one input source file including application source code and abstracted white-box function calls; receiving a parameterization file containing one or more parameterization records each of which corresponds to an abstracted white-box function call and includes cryptographic domain parameters for that abstracted white-box function call; generating white-box call definition data mapping each abstracted white-box function call to one or more routines in a white-box library based at least in part on the cryptographic domain parameters corresponding to that abstracted white-box function call, wherein generating the white-box call definition data comprises generating a white-box call definition file and white-box metadata specifying parameters chosen for each abstracted white-box function call; applying at least one data transformation to the input source file and the white-box call definition data to respectively generate a transformed source file and transformed white-box call definition data, wherein applying the at least one data transformation to the white-box call definition data generates a transformed white-box call definition file and transformation metadata specifying data transformations chosen for selected parameters; generating data initializations encapsulating the instance-specific data for each white-box function call based on the white-box call definition data and the transformed white-box call definition data; and compiling the transformed source file, the transformed white-box call definition data and the data initializations, and linking the resulting compiled code against the white-box library to provide an executable software application.