diff --git a/test/fuzztest/backupsa_fuzzer/BUILD.gn b/test/fuzztest/backupsa_fuzzer/BUILD.gn
index b0025c1ea92ecba0c6d23964185a22fc152b7624..160de50ee42349eaf8a0b734babf651c1e436b08 100644
--- a/test/fuzztest/backupsa_fuzzer/BUILD.gn
+++ b/test/fuzztest/backupsa_fuzzer/BUILD.gn
@@ -37,6 +37,7 @@ ohos_fuzztest("BackupSaFuzzTest") {
   deps = [
     "${app_file_service_path}/services/backup_sa:backup_sa",
     "${app_file_service_path}/services/backup_sa:backup_sa_ipc_stub",
+    "${path_backup}/interfaces/inner_api/native/backup_kit_inner:backup_kit_inner",
     "${path_backup}/utils:backup_utils",
   ]
 
diff --git a/test/fuzztest/backupsa_fuzzer/backupsa_fuzzer.cpp b/test/fuzztest/backupsa_fuzzer/backupsa_fuzzer.cpp
index a811dcc08f2edf70376e2308d13bc88e6435dfdb..2f4141076fd20963be281b231b952065d6fac243 100644
--- a/test/fuzztest/backupsa_fuzzer/backupsa_fuzzer.cpp
+++ b/test/fuzztest/backupsa_fuzzer/backupsa_fuzzer.cpp
@@ -15,25 +15,14 @@
 
 #include "backupsa_fuzzer.h"
 
-#include <cstddef>
-#include <cstdint>
-#include <cstring>
-
-#include <climits>
 #include "message_parcel.h"
-#include "service_stub.h"
 #include "service.h"
-#include "securec.h"
-#include "system_ability.h"
-
-#include "filemgmt_libhilog.h"
-
-using namespace OHOS::FileManagement::Backup;
+#include "service_client.h"
 
 namespace OHOS {
+using namespace OHOS::FileManagement::Backup;
 constexpr size_t U32_AT_SIZE = 4;
-constexpr uint8_t MAX_CALL_TRANSACTION = 24;
-constexpr int32_t SERVICE_ID = 5203;
+constexpr uint8_t MAX_CALL_TRANSACTION = 40;
 
 uint32_t GetU32Data(const char* ptr)
 {
@@ -47,7 +36,7 @@ bool BackupSaFuzzTest(const uint8_t *data, size_t size)
         return true;
     }
 
-    sptr service = sptr(new Service(SERVICE_ID));
+    Service* service = static_cast<Service*>(ServiceClient::GetInstance()->AsObject().GetRefPtr());
     uint32_t code = GetU32Data(reinterpret_cast<const char*>(data));
     if (code == 0) {
         return true;
diff --git a/test/fuzztest/backupservicestub_fuzzer/backupservicestub_fuzzer.cpp b/test/fuzztest/backupservicestub_fuzzer/backupservicestub_fuzzer.cpp
index 6b2c9cd2bd2c941ecd1b99aed4ba28be434fe3c2..94f3c897abbe50cc1f8757bed06c06b66b165a84 100644
--- a/test/fuzztest/backupservicestub_fuzzer/backupservicestub_fuzzer.cpp
+++ b/test/fuzztest/backupservicestub_fuzzer/backupservicestub_fuzzer.cpp
@@ -670,6 +670,26 @@ bool CmdUpdateSendRateFuzzTest(sptr<Service> service, const uint8_t *data, size_
     }
     return true;
 }
+
+bool CmdGetBackupDataSizeFuzzTest(sptr<Service> service, const uint8_t *data, size_t size)
+{
+    if (data == nullptr || size < sizeof(int32_t) + sizeof(int32_t)) {
+        return true;
+    }
+
+    MessageParcel msg;
+    MessageParcel reply;
+    MessageOption option;
+    uint32_t code = static_cast<uint32_t>(IServiceIpcCode::COMMAND_GET_BACKUP_DATA_SIZE);
+
+    try {
+        msg.WriteBuffer(data, size);
+        service->OnRemoteRequest(code, msg, reply, option);
+    } catch (OHOS::FileManagement::Backup::BError &err) {
+        // Only filter BError errors, Other results are not expected.
+    }
+    return true;
+}
 } // namespace OHOS
 
 /* Fuzzer entry point */
@@ -708,6 +728,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
         CmdGetBackupInfoFuzzTest(service, data, size);
         CmdUpdateTimerFuzzTest(service, data, size);
         CmdUpdateSendRateFuzzTest(service, data, size);
+        CmdGetBackupDataSizeFuzzTest(service, data, size);
     } catch (OHOS::FileManagement::Backup::BError &err) {
         // Only filter BError errors, Other results are not expected.
     }