for work with MPQ, imho easiest way is use Total Commander + Zezula's TotalMPQ plugin
for replacing files without patching or other intrusion, you may replace only not protected files. if you want replace protected files, you must fake protection. you may use my patcher or any other method what you want/know. you can get list of protected files, in latest patch-base from cache (\\World of Warcraft\Data\Cache\patch-base-13623.MPQ\signaturefile"). +all folders containing "*.SIG" files are protected too, filelist for that protected folders in same named "*.TOC" files.