Download and install iBackupBot.
Download address: http://1.szwt.pc0359.cn/soft/i/ibackupbot_setup.rar
Install using iBackupBot
After the installation is complete, iBackupBot will automatically search for iPhone backup files (provided that it has been backed up to the computer with itunes).
Search and locate files
Locate from backup file: System Files/HomeDomain/Library/Preferences/com.apple.restrictionspassword.plist
Edit the file (pop up the registration box, select Cancel)
The content is similar to the following (the encrypted password is marked in red):
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>RestrictionsPasswordKey</key>
<data>
XvKdq4VWAMs9meAUpe8lRSrlQYY=
</data>
<key>RestrictionsPasswordSalt</key>
<data>
7iwAzw==
</data>
</dict>
</plist>
用浏览器打开http://ios7hash.derson.us/（这个网站也讲解了如何找回密码及提供了工具下载地址）
分别填入RestrictionsPasswordKey与RestrictionsPasswordSalt
点击search for code 按钮，开始破解密码
程序会从0000开始逐一递增进行『密码穷举』一直到找到密码时，弹出的对话框提示即『访问限制密码』。设置的密码数字越大，搜索的时间越长。