Using a simple SDR receiver on my desktop to see if anything was obvious (like one unit wasn't transmitting or something equally silly!)
It was evident that two modules that couldn't communicate, were on significantly different frequencies!
In all the following images, the HC12 modules are identifying as firmware version 2.4, are set on channel 1, +20dBm and speed of 1200 bps.
(hc is a utility I've written to talk to and receive from the HC12 modules)

pi:~ $ ./hc  AT+DEFAULT
Command -> AT+DEFAULT
OK+DEFAULT

pi:~ $ ./hc  AT+V
Command -> AT+V
www.hc01.com  HC-12_V2.4

pi:~ $ ./hc  AT+RX
Command -> AT+RX
OK+B9600
OK+RC001
OK+RP:+20dBm
OK+FU3

pi:~ $ ./hc  AT+B1200
Command -> AT+B1200
OK+B1200

pi:~ $ ./hc 1200 AT+RX
Command -> AT+RX
OK+B1200
OK+RC001
OK+RP:+20dBm
OK+FU3

pi:~ $ while [ 1 ]; do ./hc "123456789.123456789.123456789.123456789.123456789.123456789.123456789.123456789.123456789."; done
Send Data <123456789.123456789.123456789.123456789.123456789.123456789.123456789.123456789.123456789.>
Send Data <123456789.123456789.123456789.123456789.123456789.123456789.123456789.123456789.123456789.>
Send Data <123456789.123456789.123456789.123456789.123456789.123456789.123456789.123456789.123456789.>

The first question was then, which was right, and was the $5 SDR even accurate!
Out with my old Marconi 2019A signal generator.
A quick re-calibration of the SDR later, and the picture becomes clear.
One unit is perfectly on-frequency, while the other is about 31KHz high!

The next thing that became obvious was that my siggen at +10dBm was drowning out the HC12 modules!
So, just for a giggle, I set the siggen to transmit a 20KHz wide FM signal modulated at 1KHz on a CF of 433.300000 MHz
and an RF level of -20dBm (just to emphasise, that is MINUS 20dBm). With a short, non-resonant antenna.

Both the HC12 antenna and the sig-gen "antenna" were about 1m from the receive antenna of the SDR, and about 200mm from each other.

Broke out the spectrum analyser.
First off, checked the Marconi wasn't doing anything stupid, like saying -20dBm but transmitting at +20!
(Image to come, seems I didn't save it). But it was right where I expected it.
Sig-Gen --> N-SMA adapter --> SMA male-male cable --> SMA-BNC adapter --> BNC-N adapter --> Spectrum Analyser.
Siggen at 433.400MHz, no modulation, +10dBm carrier. SA confirms frequency and power both exactly right.

Unplugged the SMA male-male cable from the sig-gen and plug on to the HC12, no settings changed. HC12 --> 4" long IPEX-SMA cable --> SMA male-male cable --> SMA-BNC adapter --> BNC-N adapter --> Spectrum Analyser

I've tried two different HC12 modules, and two different IPEX->SMA tails.
I've visually inspected the HC12 modules to make sure there are no missing coupling components from the RF output to the IPEX connnector.
I've done a DC continuity test from the RF output pad on the HC12 to the centre pin of the N connector at the spectrum analyser. (fraction of an ohm)
I've tested for a short from RF output to ground. (there isn't)

For reference, the HC12 is mounted on a board I make that sits on the Raspberry Pi.


The PCB has pads to solder the module to. The three RF pads (two ground and the antenna in centre) are small isolated lands
I left copper clear on the back to ensure it doesn't have any more capacitance than absolutely necessary.

A We ordered some new crystals to see if this alone is enough to fix the problems.
Here's one of the original modules with its original crystal, some 31KHz high

After swapping in the new crystal, the frequency is now within about 1KHz, but power is still down 50dB

The genuine modules we purchased from hc01.com have just arrived today, have put one on a new carrier board and fired it up.
As you can see, it isn't pretty:
* short IPEX->SMA(f) tail
* SMA(m)->SMA(m) adapter
* SMA(f)->N adapter
* 10.0dB precision attenuator



Next, Connected to the Raspberry PI, checked the module:

$ ./hc AT+RX
OK+B9600
OK+RC001
OK+RP:+20dBm
OK+FU3

$ ./hc AT+V
www.hc01.com HC-12 v2.6

$ ./hc AT+B1200
OK+B1200

$ ./hc 1200 AT+RX
OK+B1200
OK+RC001
OK+RP:+20dBm
OK+FU3

Notwithstanding the series of connections, adapters etc (and a 10dB precision attenuator to keep within the SAs input limits)
the genuine module is immediately putting out +19dBm - allow 0.2dB for each connection and it's bang on!

The final conclusion can only be that all these clone modules are using rubbish components. Not only are a good percentage of them
sufficiently off-frequency that the won't inter-operate with the genuine modules AT ALL, even if you get ones that are on-frequency,
or replace the crystals, or use all clones - their output power is so low it's difficult if not impossible to get more than
30-50m range from them.