1) \Device\ covers several things from instances of real devices, virtual devices, filters, harddrive partitions, symboliclinks and maybe more. You can view this information [and lots of other types] with a nifty program called
WinObj to see what's on your system.
2) Yes, Named Pipes are used between processes so that applications can communicate locally or remotely.
3) QWAVEdrv is a service that comes with Windows, it is not a Named Pipe used for communication. I suppose the OpenPipePath part being used for both could be confusing but it's actually because the Named Pipes are handled and treated very similar to the file system including having their own security descriptors.
4) I don't think it's so much that the sandboxed apps usually need to communicate with the antivirus but normally it's related to information the antivirus tries to send out, be it via a dll that it injects or otherwise. If all the AV program did was scan files when created or ran then these likely wouldn't be needed. However they've gotten much more involved and now cover other aspects which can require getting some information back to its services.
5) This ones a bit tougher to answer as I don't actually know much about windows internals or how exactly sandboxie does what it does related to this level.
Technically I suppose it could happen but at some point a token would need to be used and Sandboxie issues a specific token for things running inside which in turn limits what anything running inside can modify and also routes some APIs through its own handlers.
In addition to all this we should circle back to the security descriptors of the pipes themselves. If the programers created the pipes properly and set up appropriate access control then it already has its own protection from modification. With an AV it would be highly likely they've done this properly otherwise they'd constantly be an attack vector for anything to target since not everyone uses sandboxie.
Something more like the Logitech keyboard might not be as resilient (I can't say one way or the other) it just depends on if the people who made the software bothered to set up proper access control. If someone were to identify a weak pipe that you have also opened up in sandboxie and then created a highly targeted attack for it I
can't say that it would be
impossible to use it for an escape which is why it's often described as 'punching holes' in sandboxies protection.
Perhaps Curt or someone else who better understands this stuff will be able to answer the question more clearly.
