I am trying to decrypt the SSL/TLS (TLSv1.3) somewhat like WireShark using SSLKeyLog file. I learned that the AEAD is passed with payload which is the last 16 bytes of the Application Data(Not sure about this).

I tried looking at WireShark’s source code, but could not understand the dissection of the TLS packets and extraction of the records. Not sure of what keys are required for decryption, I could derive session_id, client_random, server_random, and auth tag if the above logic is correct.

As per my knowledge, I need server_iv and client_iv and of course records from the handshake, to derive the master key secret.
Please help me identify these.