I recently downloaded one apk from a custom apkstore from my country. You can download the app for free but you need to pay to use some functionalities. I cracked the app jumping over all the activation mechanism just changing a boolean 'isActivated' flag which is used in an 'if'. I did this just for curiosity because I don't need this app, but I'm wondering how can you avoid this trick.
It looks almost impossible to me. I have read you can put sensitive code in C using NDK, but you always need to say in java something like (if activation == completed) in some point. The activation mechanism looks pretty complex but I don't changed it at all, so all the thing is in the conditional. I know you can use some obfuscator but that usually just change the name of the variables and make some permutations. If somebody know how to avoid or to protect the 'if' please let me know.
Let me add that the apk is a remote control for my country custom digital TV decoders. The idea is that you can use your phone with infrared as a remote control. In this case the functionalities are in the apk, so a mechanism online with some session token seems inneffective to me because I can just ignore the token and call the functions, besides off course is annoying to have a remote control always online.