@coolstarorg If you're jailbroken (with tfp0), you can use the generator method. This allows you to put a generator in NVRAM to force generate a specific APNonce. This makes it really convenient to make the device generate the same APNonce which is also inside your APTicket.