Recover iOS 9 Restriction Password

README.md

Steps

• Create non-encrypted backup in iTunes
• Download and open iBackupBot
• Locate and open file at HomeDomain/Library/Preferences/com.apple.restrictionspassword.plist
• 
• Open https://repl.it/CY2I
• Change PASS_KEY and PASS_SALT to values from com.apple.restrictionspassword.plist
• Click run

Alternatively you can download recover.js and run it on your machine but on repl.it it runs for ≈7-10s, so it may be faster :-)

recover.js

'use strict';

const PASS_KEY = 'HbT84iDAEFcLd1aAjy3GSQ+Sjmk='; // Change to RestrictionsPasswordKey
const PASS_SALT = 'wzGRCQ==';  // Change to RestrictionsPasswordSalt
const PASS_START = '0000';
const PASS_END = '9999';


// Don't change below this line -------------------------


const crypto = require('crypto');

function atob(str) {
  return new Buffer(str, 'base64');
}

const key = atob(PASS_KEY);
const salt = atob(PASS_SALT);

function checkPass(pass) {
  return PASS_KEY === crypto.pbkdf2Sync(pass, salt, 1000, 20, 'sha1').toString('base64');
}

console.time('found in');
for (let i = parseInt(PASS_START, 10), end = parseInt(PASS_END, 10), pass; i <= end; i++) {
  pass = ("0000" + i).slice(-4);
  if (checkPass(pass)) {
    console.log(pass + ' - Found!');
    console.timeEnd('found in');
    break;
  }
  if (i % 1000 === 0) {
    console.log(i + ' checked');
  }
}