I have created an encrypted bitcoin file. I know the password and I see the mkey in the hex dump. I would like to know where the AES key / IV pair are located in the wallet.dat file?
I imagine the Bitcoin-core source code may be a good guide to the layout of a wallet.dat file. You may need to find the source of the specific version of Bitcoin core that created (or last wrote) the wallet.dat file.
There is also https://en.bitcoin.it/wiki/Wallet which points you to various resources.
The format of this file is Berkeley DB. Tools that can manipulate wallet files include pywallet.