In general the passwords can be extracted by using (on Linux or in Windows subsystem for Linux): strings CPS.exe | grep 6666 Or you can open the CPS.exe in hexeditor/file viewer and search for the string, it will show you the password.
For the menu in CPS2, you do not have to boot in test mode, you can use it in normal mode after entering the password.
I have analysed parts of the firmware in the meantime and although there are some settings in CPS.exe to enable entering another DMR ID, it seems there is no support in the firmware to do so .