The hex2000 utility does not feed the flash binary directly to the AES-128-CMAC algorithm. Before computing the authentication tag, it applies the swapwords transform, which swaps the two 16-bit words within each 32-bit group of the binary data.

For each group of 4 consecutive bytes [b0, b1, b2, b3] in the binary, where:

• [b0, b1] = [low byte, high byte] of C28x word at address N
• [b2, b3] = [low byte, high byte] of C28x word at address N+1

swapwords([b0, b1, b2, b3]) = [b2, b3, b0, b1]

This swaps the two 16-bit words within each 32-bit group, keeping each word's bytes in their natural (little-endian) order. This is equivalent to reading each pair of C28x words in reverse order (high word at N+1 before low word at N). This operation is self-invertible, meaning that applying the transformation twice to any input returns the original data unchanged.

After the AES-128-CMAC tag has been computed over the transformed data, hex2000 applies the same swapwords transform a second time to the 16-byte tag itself before embedding it in the flash image at the golden CMAC tag location (byte offset +0x4 from the flash bank entry address, corresponding to C28x word address +0x2). Both of these transforms must be replicated when using OpenSSL in order to produce a stored tag that is byte-for-byte identical to the one generated by hex2000.