Location of certs in SB5101 w/ Haxorware

After searching for a month, I decided to beg for help.
Sorry if I asked something stupid.

For stock sb5101 firmware, to grab certs can be used jtag command to read cfg.bin

But I would like to know how can I grab certs with BLACKCAT JTAG from a SB5101 with haxorware installed? (without webgui and telnet access)

Are certs stored in same location after flashing haxoware fw into it?


Any replys will be greatly appreciated.