Use the Calculator to Reveal a Mac's Firmware Password

Someone out there will find this useful someday, I promise.

The following procedure can be used in order to obtain the Firmware Utility password on older Mac laptops (2011 and earlier):

1. Obtain obfuscated firmware utility password from the PRAM with the following command:
sudo nvram security-password
The output will be similar to the following: security-password %fa%cb%d9%d9%dd%c5%d8%ce

2. The number of percent signs in the output is the number of characters in the password.  Since the Calculator can only handle words up to 8 characters (16 hex characters), if there are more than 8 symbols, then you will have to split the password up and convert in sections.

3. Copy the security password output from the Terminal to a text editor and delete the percent symbols in it, followed by splitting the password string at every 16th character.

4. You will need to perform the following on each 16-character section:
-Open the Calculator and set it to Programmer mode in the View menu or by pressing Command-3.

-Copy one 16-character section of your password and paste it into the calculator. You should see its
binary equivalent shown below the yellow-green display, and also see its ASCII-text representation at the bottom-left of the display (you may have to click the "ASCII" button to reveal this).

-Starting with the first bit in the binary output (the one furthest from the blue zero at the right), reverse every other bit by clicking its corresponding 1 or 0.

5. As you do this reversal of every other bit, you will see the ASCII output in the calculator reveal your password, or at least the section of it that is represented by the 16-character segment being operated on. Write down the revealed text password and then repeat this process for additional segments of the password, after which you should have your firmware password.

Source:
http://reviews.cnet.com/8301-13727_7-57521667-263/use-the-calculator-to-reveal-a-macs-firmware-password/