After reading this tutorial you’ll know how to create within a minute a multiboot USB containing multiple operating systems such as different Linux distributions or Microsoft Windows. In this tutorial we will explains how to create a multiboot USB in Windows in which you just need to copy any ISO you want to boot. Maybe it's legit, but (especially in combination with poorly-translated documentation) this is triggering all of my flags.With Ventoy, you don’t need to format the USB drive for each new installation, you just need to copy the ISO file to the USB drive and boot it.

OTOH, malware has a long history of 'get something running on the CPU and hide from it', which is coincidentally exactly what booting from an ISO image needs. How does Ventoy do the impossible? Does it dynamically replace the partition table so only the ISO is visible (which requires that the file be laid out contiguously, thus will fail once the disk gets used)? Does it somehow pass the whole thing as if it were an initrd and manage to get the kernel to understand that (this should be more portable than #2 but really shouldn't work)? This requires kernel support (which means Linux is mostly supported but screw everyone else) and wastes a significant amount of memory. Use a ramdisk, then tell the kernel not to clobber the given area. This typically requires rescanning all disks (and thus may find the wrong image if multiple disks have one at the same filepath - which thus may prevent repartitioning that disk), but more importantly, is not available for all distros. Use distro-specific initrd hooks to tell it that we're need to use a file rather than a partition directly.

There were only 2 working ways of booting from an ISO image inside a partition: Last I checked, what it is doing is supposed to be impossible. I'm hesitant to use Ventoy because nobody has explained how it worked.

Ventoy instructions