wimboot not releasing system memory?

[NiKiZe]

(2019-01-07 20:36)steve6375 Wrote:  I notice that ttf font files can be injected. Where are these actually copied to? What determines where different files are injected?

There is no difference for different file extensions, everything injected with wimboot goes into windows\system32.
If you are seeing fonts being loaded and working, it is because it is totally fine to load font's from the running executables directory, or any other specified path (or memorystream)