iPhone How to recover restrictions pin (jailbroken only)

[matl0ck]

Step one, use ifile to navigate to:
/var/mobile/Library/Preferences

Open com.apple.restrictionspassword.plist with the plist viewer

Make note of the key(hash) and salt...

In linux, install perl and Crypt:BKDF2

Run this script: (with hash/key as one long string, then salt as second param)

#!/usr/bin/env perl

use Crypt::PBKDF2;
if (@ARGV < 2)
{
    print "ios 7 Parental Restrictions Pin Finder\n\n";
    print "Calculates every possible hash between 0000 and 9999\n";
    print "to determine the pin used to restrict the device\n";
    print "based on the Hash and Salt contained in\n";
    print "com.apple.restrictionspassword.plist\n\n";
    print "Usage perl ios7.pl [hash] [salt]\n\n";
    exit (1);
}

my $match = pack ("H*", $ARGV[0]); #TODO: Check if it is of length 40
my $salt  = pack ("H*", $ARGV[1]); # of length 8?
my $iter  = 1000;

my $pbkdf2 = Crypt::PBKDF2->new (hash_class => 'HMACSHA1', iterations => $iter);

my $num;

for ($num = 0; $num < 10000; $num++)
{
  my $pass = sprintf ("%04d", $num);

  my $hash = $pbkdf2->PBKDF2 ($salt, $pass);
  
  if ($match eq $hash)
  {
    printf ("%s:%s:%s:%s\n", unpack ("H*", $hash), unpack ("H*", $salt), $iter, $pass);
    exit (0);
  }
}
exit (1);

Profit