I dumped a filelist of my Hero to my SDCard, then found the EPST.odex and EPST.apk. so I copied them to my memcard ('cp' returns permission denied in ConnectBot, but 'cat' works, so basically to copy a file, run something like 'cat /system/app/EPST.apk > /sdcard/EPST.apk' (without quotes)).
anyway, i ran 'strings' on the file and found the following interesting section:
res/xml/epst_akey.xml
res/xml/epst_data.xml
res/xml/epst_msl.xml
res/xml/epst_otksl.xml
res/xml/epst_prev.xml
res/xml/epst_prl.xml
res/xml/epst_rtn.xml
res/xml/epst_scrtn.xml
res/xml/epst_vocode.xml
These all translate to ## codes:
NOTE: Patience is required when entering a code. It may take up to 20 seconds for EPST to open.
##3282# ~ DATA
##(yourmsl)# ~ MSL
##(yourOTKSL)# ~ OTKSL is the One Time Keypad Subsidy Lock. Don't know where you'd get this.
##7738# ~ PREV ~ Set PREV
##775# ~ PRL ~ Lets you load a .prl file from any path
##786# ~ RTN ~ Factory Reset
##72786# ~ SCRTN ~ Looks like a enhanced ##(yourmsl)# with data username & password
##8626997# ~ VOCODER ~ Vocoder Settings
Most of these require your MSL.
More as I find em

Edit: finally realized apk is just a gzip archive. But not finding anything new inside the files in the apk.
Edit 2: DUN NAI option exists in EPST. Still need to figure out how to access it. It will require your MSL, but we shouldn't need root.
Edit 3: Cannot find any new codes, but DUN NAI is in the strings for /system/apps/EPST.apk/resources.asrc (open apk in winrar after renaming to gz)