When logical decryption fails, physical chip decapsulation opens the IC package to extract firmware directly from silicon.

Decapsulation Methods:
1. Acid Etching: boiling nitric/sulfuric acid dissolves epoxy over the die.
2. Laser Opening: focused laser ablates package around die.
3. Mechanical Polishing: grinding away package layer by layer.

Firmware Extraction from Die:
- EMMI/SPEMI: photon emission reveals stored data.
- Microprobing: needles touch metal interconnects.
- Laser Voltage Imaging: scan operating signals.
- Side-Channel: power/EM analysis.

Physical decapsulation is used when:
- RDP Level 2 locks debug permanently
- Fault injection fails
- High-security chips need deep analysis
- PCB reverse engineering requires firmware backup

This method is destructive but recovers firmware from the most protected MCUs.