Unfortunately, I don't believe there is a way to recover a password-protected program from a Magelis HMI.
The closest thing I can think of is runtime recovery to erase a password-protected program which will allow you to download your own program to the HMI hardware. However, it seems like that is not what you are after.
Sorry I couldn't be of more help.