Patching

A ‘pwn’ binary with no input is really a static-reversing puzzle: a fake usleep loop would take days and a fake integrity check always passes, so reading the constants and undoing a single-byte XOR yields the flag without ever waiting.

A UPX-packed, unstripped crackme lays its 44-byte check out as 44 independent per-character functions; emulating each with Unicorn brute-forces the flag one byte at a time, sidestepping a rand()-based anti-dynamic trap.