Not that simple to bypass. Without going into details;
"appending a MD5 hash (plus a bit of arcania) to the end"

1) Maybe it is a SHA1 rather than an MD5
2) The hash is 'salted'; not simple to replicate
2) 'arcania' is made of things like epoch time and size and such
3) values are interleaved at a byte level.

Suffice to say, the substitution of one file for another is a more complex task.
Placing values in a seperate file leave the question of that external files integraty at question.


Nothing wholey self-contained can ever be secure.
Given enough resources, it can be comprimised.
But the quantity of resources to compromise it can
be forced to extremely high levels.

BillS