It depends on how your friend used the passphrase to generate addresses. I'm assuming that you didn't use any wallets like Electrum, Bitcoin-qt (back then), Armory, etc? The hashing hasn't changed and P2SH and P2PKH were the most prominent address types back then. If you cannot remember how it was generated, then it would likely just be like finding a needle in a haystack.
Like you mentioned above, I am almost certain OP looks for brainwallets.
If not, then perhaps they used Bitcoin-QT, which was already established and used by most people back then. But if so, there is no way to find the coins without a wallet backup.