See the answer at: http://omappedia.org/wiki/Android_eMMC_Booting#Modifying_.IMG_Files
First you need to "uncompress" userdata.img with simg2img, then you can mount it via the loop device.
userdata.img
simg2img
2.1m questions
2.1m answers
60 comments
57.0k users