Fake GC-01: What MCU is it?

[gtoal]

After watching "Project 326"'s Youtube videos on the GC01, I felt confident enough to buy a cheap one from Temu at a ridiculous $21 and ordered a J321 off eBay for a little less, thinking that I'd have no problem updating the tube and the firmware... well, on opening the case I find that the manufacturer has done the usual dirty trick of scraping off the identifying details from the MCU! (and the tube is quite anonymous too, but it's a safe bet that whatever it is, it still needs to be replaced with a J321...) So... does anyone have a good guess as to what the MCU might be here? Photo attached. (This is the source: https://www.temu.com/goods.html?_bg_fs=1&goods_id=601100084551123&sku_id=17594646284050 )

[jonwhite227]

That's one of the very cheap clones with different circuitry, an 18650 type battery and a J613/4 tube. It should have a flat cell fixed inside the lid. It doesn't look as if even the clips are fitted to the board to mount a J321. Unless someone knows otherwise, you can't put RadPro on this clone.
The best source is the Fnirsi Official Store on Ali Express - you might get the cheaper tube, but the rest will be correct and should have tube mounting clips on the board. My second one came from here and all was required was swapping the tube. It only costs about another $10-12 to get the genuine article, which will take RadPro and give quite a capable little counter for well under $50.
Sadly if something is 'cheap' from China, there's usually a very good reason... You definitely get what you pay for.

[gtoal]

Appreciate the info, thanks. Yeah, I'ld noticed the lack of clips too. I'd put it down to cheap-assed cost engineering but it hadn't occurred to me that this was an even cheaper 3rd party superficial lookalike of the OEM. Anyway, I've placed a new order as you suggest ($38). Fingers crossed that it is indeed the legit board and not another Chinese copy of the Chinese original.

[gtoal]

I'm happy to report that the replacement from the FNIRSI store which arrived today

is indeed the desired hardware. I was a little bit afraid it might have the new cheaper board in it too!

It's very hard not to think that the cheaper one is made by the same factory. The tooling is identical though the plastics and rubber parts are marginally different material - but the only major difference is the entirely new PCB. The boxes are near identical too. The display on the cheap clone is actually slightly better - brighter and slightly larger fonts. The software is almost identical - a couple of bits of text that were coloured in the original are reverse-videoed in the clone. The FNIRSI came with only 3 minutes of previous use on the clock compared to the rather dubious many hours on the clone! The FNIRSI appears to have a J707 tube in it. I have a J321 arriving in a few days and should be no problem swapping in this one which does have the proper clips.

With the tube that comes with it, there doesn't seem to be a lot of difference other than natural fluctuations in the readings between the two - sometimes one is higher, sometimes the other.

The only other difference I can see is that the clone doesn't have an L.E.D. to signal ionization events. Before I came across this radpro project, I had been planning to tap off a feed from the input to that L.E.D. so I could feed my computer directly. Which also would not have been possible with the clone. But not needed now because the replacement firmware can feed data to a computer (as one more sensor for our home weather station. I already added a particulate matter sensor.)

(Later note: I was also surprised to find that the cheaper clone lasted about twice as long on a full charge than the FNIRSI. Did not expect that! )

[gtoal]

NOTE the labelling on the ST-Link jumper holes... Firstly, the printing is mirrored, but what it says is VCC GND DIO CLK - which - even if the pins were accidentally labelled in reverse order - can not match the description in the installation page, where the unit you're using seems to be Vcc DIO CLK Gnd. Either the labelling on this one is wrong or your documentation is wrong or - and far more likely - they've changed the circuit board. So if the latter, probably worth a loud warning on the installation page https://github.com/Gissio/radpro/blob/main/docs/devices/FNIRSI%20GC-01/install-stlink.md since you say 'Make sure the electrical connections are correct. You may break your device if the connections are not correct.'.

[Gissio]

Could somebody dump the firmware of this device?

[gtoal]

Well, I don't know anything! Plugging it in to either a Windows 11 PC or a Raspberry Pi Linux has no effect whether it is powered on or off when plugging in, or changing the power status after plugging it in. No filesystem appears on Windows and 'lsusb' on linux shows no new devices. My cable is definitely a data cable as confirmed by a USB tester (and having used it on other devices). My suspicion would be that the USB port on the clone is hard wired for charging only. Although I have some clamps for connecting to 0.1in pitch chips, I have no way of accessing one of these surface mount chips directly. Unless you have some suggestion, I'm done :-/ Sorry.

[Gissio]

What about that 4-pin header?

[gtoal]

J1? Possible. It is in the right place to match the one on the FNIRSI. Usually 'J' is a jumper so it hadn't occurred to me it was the serial port. I'll put it on the scope some time in the next week and see if anything comes out of it when powering up.

[Gissio]

It looks like SWD!

[gtoal]

I've never used that but I thought SWD was 3-pin not 4? (hence the 'S' in 'Single wire')

[gtoal]

Hey, tell me I'm not imagining this - the tube that the FNIRSI in the photo above came with - it was a J321??? I only just now noticed it as I was checking the MCU while installing your firmware! Unfortunately I had placed an order for a J321 separately at the same time as I ordered the GC-01 so I guess I'll have a spare tube soon!
PS I noticed on Ali Express yesterday that the FNIRSI store had bumped the price of the GC-01 up from $37 to $47! - maybe they just noticed the J321 tubes too :-) - their current page does explicitly say that it is a J321 ... I didn't pay attention as to whether it said that when I ordered it a couple of weeks ago.

[gtoal]

By the way, plugging the FNIRSI in to a raspberry pi in order to charge it broke it! The filing system showed UNKNOWN.TXT, the red LED came on permanently, and the screen stayed black no matter what you pressed. But since I could see the filing system when I plugged it in to my windows portable, I knew it was up enough that I could do the firmware update - which I had been holding off on doing until the J321 I had ordered separately arrived. (That was when I discovered that the device already contained a J321! I noticed it not because I looked at the tube more closely, but because when I ran radpro, the background readings that I was getting were about 3X higher than before! It looks like the original firmware was deliberately scaling it down so that all their devices would report similar readings regardless of whether they had J321's or the cheaper tubes!)

[Mr-Blinky]

I don't know if this helps or not - I have exactly the same counter from Aliexpress. No USB connectivity and no markings on the MCU. I found that if you turn the unit off then plug in a USB charger, then hold the UP button for some seconds it prints what looks like the MCU type on the screen. In my case it is 'CA32F1056L2-Z94'. I think the MCU in this unit may be a CA32F1056L2. Now the not so helpful part, I can't find anything about this chip, except it is listed on JLCPCB.

[Mr-Blinky]

Some more on this. If this MCU is a CA32F0156L2 then I have traced the SWDIO/SWCLK/voltages etc. on the pin header. Strangely, they also go to the USB C connector (6-pins) onto pins A5 and B5 (CC1 & CC2?). Going from top to bottom (bottom being the USB end) the header is +3.0v, SWDIO, SWCLK, GND - Marked on the following picture.

I also got the pinout for the CA32F0156L2, but no datasheet.

[gtoal]

Google translate of http://bbs.sunsili.com/thread-270244-1-1.html is helpful:

【IC Recommendation】Jinrui MCU CA32F0156L2ARM Cortexx®-M0 32-bit RISC core, main frequency 64Mhz, FLASH128KB, SRAM16KB, one I2C, one SPI, three serial ports), two 12-bit ADCs, one timer with 7-channel PWM, two general timers with 7-channel PWM, and one basic timerThe CA32F01 series uses a high-performance ARM Cortexx®-M0 32-bit RISC core, a higher operating frequency of 64Mhz, high-speed embedded flash memory (FLASH up to 128K bytes, SRAM up to 16K bytes), and extensively integrates enhanced peripherals and I/O ports. It provides a variety of standard communication interfaces (one I2C, one SPI, three serial ports), two 12-bit ADCs, one timer with 7-channel PWM, two general-purpose timers with 7-channel PWM, and one basic timer. The CA32F01 series operates in a temperature range of -40 to +85°C, a power supply voltage of 2.0V to 5.5V, and has a set of power-saving modes for low-power designs.Product Details ARM 32-bit Cortex®-M0 CPU (64 MHz MAX) Memory   128K bytes Flash memory   16K bytes of SRAM CRC calculation unit   Reset and power management   Voltage range: 2.0 - 5.5V   Power-on/Power-down Reset (POR/PDR)   Programmable Voltage Detector (LVD) Clock part   External 4 to 24MHz oscillator   External 32.768KHz RTC oscillator   Internal 16MHz RC oscillator   Built-in high-speed PLL   Internal 128KHz RC oscillator   Supports 1 clock output, which can be configured as system clock, HSE, HSI, LSE, LSI or 2-divided PLL output Up to 46 high-speed I/O ports   All can be mapped as external interrupt inputs   PB4~PB11, 8 large current sink ports 5-channel DMA controller 12-bit ADC (up to 12 sampling channels)   Built-in 1 high-speed ADC1 supporting 1Mbps sampling rate   Built-in 1 100Kbps sampling rate ADC0   3 reference voltages: external reference VREF, VCC, internal reference 1.5V 2 independent analog comparators with programmable inputs LCD/LED driver, supports up to 8COM x 32SEGM. Total 40 pin outputs   Maximum support 8com x 32seg, 7com x 33seg, 6com x 34seg, 5com x 35seg, 4com x 36seg   Configurable duty cycle: 1/2, 1/3, 1/4, 1/5, 1/6, 1/7, 1/8 Duty   Configurable bias: 1/2, 1/3, 1/4 Bias   Supports 4 levels of driving current, users can adjust according to different LCD screens   Support 8 levels of LED brightness (LCD contrast) adjustment Up to 24 capacitive sensing channels, touch button sensors 7 timers   One 16-bit 7-channel timer for 7-channel PWM output with dead time generator and emergency brake function   Two 16-bit general-purpose timers, each with up to 4 input capture or output compare channels, with dead time generator   One 16-bit basic timer   Independent, windowed watchdog timer  SysTick timer RTC real-time clock, supports alarm events and periodic wake-up Communication interface   One I2C interface   3-way USART interface   1 SPI interfaceSerial two-wire debug (SWD) 96-bit ID Package LQFP48

Jinrui MCU , CA32F0156L2

【IC Recommendation】Jinrui MCU CA32F0156L2 ARM Cortexx®-M0 32-bit RISC core, main frequency 64Mhz, FLASH128KB, SRAM16KB, one I2C, one SPI, three serial ports), two 12-bit ADCs, one timer with 7-channel PWM, two general timers with 7-channel PWM, and one basic timer The CA32F01 series uses a high-performance ARM Cortexx®-M0 32-bit RISC core, a higher operating frequency of 64Mhz, high-speed embedded flash memory (FLASH up to 128K bytes, SRAM up to 16K bytes), and extensively integrates enhanced peripherals and I/O ports. It provides a variety of standard communication interfaces (one I2C, one SPI, three serial ports), two 12-bit ADCs, one timer with 7-channel PWM, two general-purpose timers with 7-channel PWM, and one basic timer. The CA32F01 series operates in a temperature range of -40 to +85°C, a power supply voltage of 2.0V to 5.5V, and has a set of power-saving modes for low-power designs.

Product Details

 ARM 32-bit Cortex®-M0 CPU (64 MHz MAX)
 Memory
 128K bytes Flash memory
 16K bytes of SRAM
 CRC calculation unit
 Reset and power management
 Voltage range: 2.0 - 5.5V
 Power-on/Power-down Reset (POR/PDR)
 Programmable Voltage Detector (LVD)
 Clock part
 External 4 to 24MHz oscillator
 External 32.768KHz RTC oscillator
 Internal 16MHz RC oscillator
 Built-in high-speed PLL
 Internal 128KHz RC oscillator
 Supports 1 clock output, which can be configured as system clock, HSE, HSI, LSE, LSI or 2-divided PLL output
 Up to 46 high-speed I/O ports
 All can be mapped as external interrupt inputs
 PB4~PB11, 8 large current sink ports
 5-channel DMA controller
 12-bit ADC (up to 12 sampling channels)
 Built-in 1 high-speed ADC1 supporting 1Mbps sampling rate
 Built-in 1 100Kbps sampling rate ADC0
 3 reference voltages: external reference VREF, VCC, internal reference 1.5V
 2 independent analog comparators with programmable inputs
 LCD/LED driver, supports up to 8COM x 32SEGM. Total 40 pin outputs
 Maximum support 8com x 32seg, 7com x 33seg, 6com x 34seg, 5com x 35seg, 4com x 36seg
 Configurable duty cycle: 1/2, 1/3, 1/4, 1/5, 1/6, 1/7, 1/8 Duty
 Configurable bias: 1/2, 1/3, 1/4 Bias
 Supports 4 levels of driving current, users can adjust according to different LCD screens
 Support 8 levels of LED brightness (LCD contrast) adjustment
 Up to 24 capacitive sensing channels, touch button sensors
 7 timers
 One 16-bit 7-channel timer for 7-channel PWM output with dead time generator and emergency brake function
 Two 16-bit general-purpose timers, each with up to 4 input capture or output compare channels, with dead time generator
 One 16-bit basic timer
 Independent, windowed watchdog timer  SysTick timer
 RTC real-time clock, supports alarm events and periodic wake-up
 Communication interface
 One I2C interface
 3-way USART interface
 1 SPI interface
Serial two-wire debug (SWD)
 96-bit ID
 Package LQFP48

Jinrui MCU , CA32F0156L2

[pingumacpenguin]

I know I'm late to the party here, but I notice that there is a flash chip next to the processor, suggesting that most of the firmware is possibly external to the device, assuming the external flash is not dedicated to storing the log of cpm.

The chip in question is the P25Q16H and the datasheet is here

https://www.puyasemi.com/download_path/%E6%95%B0%E6%8D%AE%E6%89%8B%E5%86%8C/Flash/P25Q16H_Datasheet_V2.1.pdf

If you have access to a flash reader, you should be able to grab the current contents from there.

You may even be able to persuade ChatGPT to analyse it for you. I have just picked a probably identical clone from China but I'll not get a chance to dump this myself for a while. There is an even cheaper clone on ebay/AliExporess with a simpler case, display and button layout, It may use the same or similar CPU. I may pick one of those up too if I have time.

[pingumacpenguin]

The CA32F0156L2ARM part has a very similar set of peripherals to the STM32F103C8 - as used on the very common so called "bluepill" boards. The pinout is however entirely different and the CA32F0156L2ARM seems to be a slightly less capable cortex M0 rather than the M3 of the STM part - For this application (counting clicks, running an internal Real Time Clock peripheral and driving a display) there isn't much to choose between them. I suspect the CA32F0156L2ARM is considerably less expensive even in modest volumes.

The genuine GC-01 seems to use one of... STM32F051C8, GD32F150C8, or GD32F103C8 with the GD32F103C8 being an almost identical Chinese clone of the STM32F103C8 - so since these devices are all of very similar architecture, it might be possible to port RadPRO to this clone.

[pingumacpenguin]

Processor appears to be about 0.5 renminbi on Taobao - about seven US cents, so yes, if my Google Fu is correct, this is a very cheap option for an ARM M0

https://world.taobao.com/item/788648937684.htm

[pingumacpenguin]

So far as I am aware the STM32F051C8 part is also an M0 - so any code written for this might be a good starting point for porting to the CA32F0156L2ARM

CA32F0156L2ARM - 48 PIN QFP - (LQFP48(7x7mm))

[pingumacpenguin]

Translated basic CA32F0156L2 datasheet.

Datasheet1.zh-CN.en.pdf

Source -> https://www.zhwssz.com/uploads/file/20230618/9976584707c5c80c7e8013a9aa091942.pdf

Interesting info around page 20 - Table 4-1Register set start address... etc.

[pingumacpenguin]

I asked AI to compare the registers with the STM32 series. It found a close match specifically the STM32F4X IO map.
As you can see it is very similar, but not quite the same.

Your detailed list provides an extensive mapping of peripheral addresses.

Below are some discrepancies and observations compared to typical address mappings for STM32F4 microcontrollers:

Identified Discrepancies

1. UART Address Conflicts:

   • UART0: You list 0x4000 1400 – 0x4000 17FF. This is likely intended to represent USART1, as STM32F4 series typically has USART1 at 0x4001 3800.
   • UART2: Listed as 0x4000 1800 – 0x4000 17FF, which is incorrect. This address overlaps with UART0 and is also invalid due to the same ending address.

2. Incorrect Definition Areas:

   • TIM6 Address: The standard mapping might differ somewhat. You could check if TIM6 is at 0x4000 1000 – 0x4000 13FF for some STM32 models.
   • TIM14: Usually, TIM14 is at 0x4000 2000 – 0x4000 23FF, which matches.

3. Peripheral Alignment:

   • TK, LXD, DIV32: These specific peripherals do not correspond to standard STM32F4 peripherals. They may belong to a very specific or modified version.
   • RESERVED Areas: The extensive reserved areas listed (especially between 0x4000 0800 to 0x4001 1FFF) should be confirmed against a specific reference manual as they might not align across all models.

4. Incorrectly labeled peripherals:

   • SPI1 should be checked as it may not map directly to 0x4001 3000. For STM32F4 series, SPI peripherals may start at different addresses depending on the specific variant.

5. DMA:

   • The DMA controller is usually defined at 0x4002 0000, but further verification against the reference manual is needed for specific variants.

Summary Table of Discrepancies

Address Range	Issue Description
0x4000 1400 – 0x4000 17FF (UART0)	Likely represents USART1, not a "UART0" and overlaps with another peripheral.
0x4000 1800 – 0x4000 17FF (UART2)	Incorrect overlap between UART0 and UART2.
0x4001 0800 – 0x4001 0BFF (TK)	Not standard; verify validity.
0x4001 0C00 – 0x4001 0FFF (LXD)	Not standard; verify validity.
0x4001 1000 – 0x4001 13FF (DIV32)	Not standard; verify validity.
0x4001 3000 (SPI1)	Potential address mismatch; check STM32F4 variant.

Conclusion

The address map has several discrepancies when compared to the standard STM32F4 family peripheral mappings. For definitive validation, it is essential to consult the specific reference manual corresponding to the exact STM32 model in question. If you have a particular model you’re considering, I can help provide targeted information!

[pingumacpenguin]

The fake GC-01 display is probably a 2.4' ILI9341 LCD Display (SPI?)

These can be found fairly inexpensively with the 18 pin interface shown above that matches @Mr-Blinky 's device

[pingumacpenguin]

To determine which processor matches most closely to the CA32F1056 in terms of specs, especially focussing on 128KB Flash, 16KB SRAM, and peripheral features such as Timer, ADC, RTC, USART, IIC, SPI, COMP, and Capacitive Touch Buttons, let's analyze the CA32F1056 briefly:

CA32F1056 Overview

• Core: ARM Cortex-M0
• Flash Memory: 128KB
• SRAM: 16KB
• Peripherals: Includes features like multiple timers, ADCs, communication interfaces (USART, IIC, SPI), and capacitive touch capability.

Closest Match

Based on the specifications of the CA32F1056, the Microchip ATSAMD20 is the closest match:

Specification	CA32F1056	Microchip ATSAMD20
Flash Memory	128 KB	128 KB
SRAM	16 KB	16 KB
ADC	Yes (12-bit)	Yes
RTC	Yes	Yes
USART	Yes	Yes
IIC	Yes	Yes
SPI	Yes	Yes
COMP	Yes	Yes
Capacitive Touch Buttons	Yes	Yes
Max Clock	48 MHz	48 MHz

Additional Details

• Microchip ATSAMD20: Comes with various communication protocols and is tailored for low-power applications. It also provides ample support for different interfaces comparable to the CA32F1056, making it a suitable alternative.

Overall, while both processors share similar specifications, the ATSAMD20 offers a slightly more modern architecture while still adhering closely to the functionalities you are looking for.

[ge0rg]

I also got one of these Geiger Counterfeit 01 devices. Same inner life as reported by @gtoal, ~9cm long unlabeled tube, no way to trigger USB mass-storage mode, reports as "CA32F0156L2-62" when holding "up".

The front side of the PCB has a two-line label "20240412" and "XBH-H240-VER1.6". Ironically, the case has a "FNIRSI" label above the LCD.

Did the RadPro port go anywhere yet?

[Mr-Blinky]

I tried to download the firmware from this fake GC-10. I know next to nothing about SWD and the STLink software, but guided by AI I did manage to at least get this thing to connect and probe the MCU. However, every time it keeps coming back with 'unknown chip id!'. This has a chip ID of 0x0200, or 0x200 depending on command.

C:\stlink\bin>st-info --chipid
0x0200

C:\stlink\bin>st-flash read firmware.bin 0x08000000 0x20000
st-flash 1.7.0
2026-04-21T19:09:12 WARN common.c: unknown chip id! 0x200
Failed to connect to target

AI couldn't help much on this at this point and basically said if it is unknown to the software, then it ain't gonna work. So I really can't see this going anywhere because if the software doesn't know the chip it is just going to refuse. I guess it was worth a shot, but now I think I will simply retire my fake GC-10 because I'm not going to put in a half-decent tube with the unit running shoddy firmware.