diff --git a/test/fuzztest/BUILD.gn b/test/fuzztest/BUILD.gn
index 1c4a33acaca84456e4ced6a5b2f1fded21826eaa..83de4d11ed5e2da8a310276d0690c1ebc1ce4369 100644
--- a/test/fuzztest/BUILD.gn
+++ b/test/fuzztest/BUILD.gn
@@ -18,8 +18,15 @@ group("fuzztest") {
     # deps file
     "backupext_fuzzer:BackupExtFuzzTest",
     "backupsa_fuzzer:BackupSaFuzzTest",
-    "backupsaanother_fuzzer:BackupSaAnotherFuzzTest",
-    "backupsaappend_fuzzer:BackupSaAppendFuzzTest",
+    "backupsaappdone_fuzzer:BackupSaAppDoneFuzzTest",
+    "backupsaappendbundlesrestoresession_fuzzer:BackupSaAppendBundlesRestoreSessionFuzzTest",
+    "backupsaappfileready_fuzzer:BackupSaAppFileReadyFuzzTest",
+    "backupsafinish_fuzzer:BackupSaFinishFuzzTest",
+    "backupsagetlocalcapabilities_fuzzer:BackupSaGetLocalCapabilitiesFuzzTest",
+    "backupsainitbackupsession_fuzzer:BackupSaInitBackupSessionFuzzTest",
+    "backupsainitrestoresession_fuzzer:BackupSaInitRestoreSessionFuzzTest",
+    "backupsapublishfile_fuzzer:BackupSaPublishFileFuzzTest",
+    "backupsastart_fuzzer:BackupSaStartFuzzTest",
     "backupservicestub_fuzzer:BackupServiceStubFuzzTest",
     "fileshare_fuzzer:FileShareFuzzTest",
     "remotefileshare_fuzzer:RemoteFileShareFuzzTest",
diff --git a/test/fuzztest/backupext_fuzzer/backupext_fuzzer.cpp b/test/fuzztest/backupext_fuzzer/backupext_fuzzer.cpp
index a100e64faaa04738df7be32ed49a042aa5605b7a..c921424d2cfb7f017adf6b47cb651bc8d1c56769 100644
--- a/test/fuzztest/backupext_fuzzer/backupext_fuzzer.cpp
+++ b/test/fuzztest/backupext_fuzzer/backupext_fuzzer.cpp
@@ -348,6 +348,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
     auto extension = OHOS::sptr<OHOS::FileManagement::Backup::BackupExtExtension>(
         new OHOS::FileManagement::Backup::BackupExtExtension(extBackup, ""));
 
+    OHOS::OnRemoteRequestFuzzTest(extension, data, size);
     OHOS::InitFuzzTest(extBackup, data, size);
     OHOS::OnCommandFuzzTest(extBackup, data, size);
     OHOS::OnConnectFuzzTest(extBackup, data, size);
@@ -373,7 +374,6 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
         OHOS::CmdHandleIncrementalBackupFuzzTest(extension, data, size);
         OHOS::CmdIncrementalOnBackupFuzzTest(extension, data, size);
         OHOS::CmdGetIncrementalBackupFileHandleFuzzTest(extension, data, size);
-        OHOS::OnRemoteRequestFuzzTest(extension, data, size);
     } catch (OHOS::FileManagement::Backup::BError &err) {
         // Only filter BError errors, Other results are not expected.
     }
diff --git a/test/fuzztest/backupsa_fuzzer/backupsa_fuzzer.cpp b/test/fuzztest/backupsa_fuzzer/backupsa_fuzzer.cpp
index 7f4e7a15622f8144d5f122e13e75a3abee19fcd2..8bd10a0d6ab1c2d8d13f96c9421ba6070aff75b7 100644
--- a/test/fuzztest/backupsa_fuzzer/backupsa_fuzzer.cpp
+++ b/test/fuzztest/backupsa_fuzzer/backupsa_fuzzer.cpp
@@ -61,7 +61,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t dataSize)
     } catch (OHOS::FileManagement::Backup::BError &err) {
         HILOGE("BackupSaFuzzTest error");
     } catch (...) {
-        // filter other error
+        HILOGE("BackupSaFuzzTest exception");
     }
     return 0;
 }
\ No newline at end of file
diff --git a/test/fuzztest/backupsaanother_fuzzer/backupsaanother_fuzzer.cpp b/test/fuzztest/backupsaanother_fuzzer/backupsaanother_fuzzer.cpp
deleted file mode 100644
index 8c3ae92d8cd04655bea0f5e016cb2c184f7ce5a8..0000000000000000000000000000000000000000
--- a/test/fuzztest/backupsaanother_fuzzer/backupsaanother_fuzzer.cpp
+++ /dev/null
@@ -1,319 +0,0 @@
-/*
- * Copyright (c) 2024 Huawei Device Co., Ltd.
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#include "backupsaanother_fuzzer.h"
-
-#include <cstddef>
-#include <cstdint>
-#include <cstring>
-#include <climits>
-#include <fuzzer/FuzzedDataProvider.h>
-#include <vector>
-
-#include "message_parcel.h"
-#include "sandbox_helper.h"
-#include "service.h"
-#include "service_proxy.h"
-#include "service_reverse.h"
-#include "service_stub.h"
-#include "securec.h"
-#include "system_ability.h"
-
-using namespace std;
-using namespace OHOS::FileManagement::Backup;
-
-namespace OHOS {
-constexpr int32_t SERVICE_ID = 5203;
-
-bool CmdGetFileHandleFuzzTest(const uint8_t *data, size_t size)
-{
-    MessageParcel datas;
-    datas.WriteInterfaceToken(ServiceStub::GetDescriptor());
-    int pos = (size + 1) >> 1;
-    if (size > 0) {
-        std::string param(string(reinterpret_cast<const char*>(data), pos));
-        datas.WriteString(param);
-    }
-
-    if (size > 1) {
-        std::string param(string(reinterpret_cast<const char*>(data + pos), size - pos));
-        datas.WriteString(param);
-    }
-    datas.RewindRead(0);
-    MessageParcel reply;
-    MessageOption option;
-
-    sptr service(new Service(SERVICE_ID));
-    service->OnRemoteRequest(static_cast<uint32_t>(IServiceIpcCode::COMMAND_GET_FILE_HANDLE),
-        datas, reply, option);
-    service = nullptr;
-    return true;
-}
-
-bool CmdAppendBundlesBackupSessionFuzzTest(const uint8_t *data, size_t size)
-{
-    MessageParcel datas;
-    datas.WriteInterfaceToken(ServiceStub::GetDescriptor());
-    if (size > 0) {
-        vector<string> bundleNames;
-        for (size_t i = 0; i < size; i++) {
-            string param(reinterpret_cast<const char*>(data), size);
-            string name = param + to_string(i);
-            bundleNames.push_back(name);
-        }
-        datas.WriteStringVector(bundleNames);
-    }
-
-    datas.RewindRead(0);
-    MessageParcel reply;
-    MessageOption option;
-
-    sptr service(new Service(SERVICE_ID));
-    uint32_t code = static_cast<uint32_t>(IServiceIpcCode::COMMAND_APPEND_BUNDLES_BACKUP_SESSION);
-    service->OnRemoteRequest(code, datas, reply, option);
-    service = nullptr;
-    return true;
-}
-
-bool CmdReleaseFuzzTest(const uint8_t *data, size_t size)
-{
-    MessageParcel datas;
-    datas.WriteInterfaceToken(ServiceStub::GetDescriptor());
-    datas.WriteBuffer(data, size);
-    datas.RewindRead(0);
-    MessageParcel reply;
-    MessageOption option;
-
-    sptr service(new Service(SERVICE_ID));
-    uint32_t code = static_cast<uint32_t>(IServiceIpcCode::COMMAND_RELEASE);
-    service->OnRemoteRequest(code, datas, reply, option);
-    service = nullptr;
-    return true;
-}
-
-void GetBundleNamesData(const uint8_t *data, size_t size, vector<BIncrementalData> &bundleNames)
-{
-    int minLen = sizeof(int64_t) + sizeof(int) + sizeof(int32_t);
-    if (size < minLen + 1) {
-        return;
-    }
-    FuzzedDataProvider fdp(data, size);
-    uint8_t loop = fdp.ConsumeIntegral<uint8_t>();
-    size--;
-    if (loop == 0 || (minLen * loop) > size) {
-        return;
-    }
-    int blob = (size / loop);
-    int len = (blob - minLen) >> 1;
-    for (size_t i = 0, pos = 1; i < loop; i++, pos += blob) {
-        int64_t nTime = fdp.ConsumeIntegral<int64_t>();
-        int fd = fdp.ConsumeIntegral<int>();
-        int32_t priority = fdp.ConsumeIntegral<int32_t>();
-        string name(reinterpret_cast<const char*>(data + pos + minLen), len);
-        string parameters(reinterpret_cast<const char*>(data + pos + len + minLen), len);
-        BIncrementalData incrementaData(name, nTime, fd, parameters, priority);
-        bundleNames.push_back(incrementaData);
-    }
-}
-
-template <typename T>
-void WriteParcelableVector(const std::vector<T> &parcelableVector, Parcel &data)
-{
-    if (!data.WriteUint32(parcelableVector.size())) {
-        return;
-    }
-
-    for (const auto &parcelable : parcelableVector) {
-        if (!data.WriteParcelable(&parcelable)) {
-            return;
-        }
-    }
-
-    return;
-}
-
-bool CmdGetLocalCapabilitiesIncrementalFuzzTest(const uint8_t *data, size_t size)
-{
-    MessageParcel datas;
-    datas.WriteInterfaceToken(ServiceStub::GetDescriptor());
-    if (size >= sizeof(int32_t)) {
-        vector<BIncrementalData> bundleNames;
-        GetBundleNamesData(data, size, bundleNames);
-        WriteParcelableVector(bundleNames, datas);
-    }
-
-    datas.RewindRead(0);
-    MessageParcel reply;
-    MessageOption option;
-
-    sptr service(new Service(SERVICE_ID));
-    uint32_t code = static_cast<uint32_t>(IServiceIpcCode::COMMAND_GET_LOCAL_CAPABILITIES_INCREMENTAL);
-    service->OnRemoteRequest(code, datas, reply, option);
-    OHOS::AppFileService::SandboxHelper::ClearBackupSandboxPathMap();
-    service = nullptr;
-    return true;
-}
-
-bool CmdInitIncrementalBackupSessionFuzzTest(const uint8_t *data, size_t size)
-{
-    MessageParcel datas;
-    datas.WriteInterfaceToken(ServiceStub::GetDescriptor());
-    datas.WriteBuffer(data, size);
-    datas.RewindRead(0);
-    MessageParcel reply;
-    MessageOption option;
-
-    sptr service(new Service(SERVICE_ID));
-    uint32_t code = static_cast<uint32_t>(IServiceIpcCode::COMMAND_INIT_INCREMENTAL_BACKUP_SESSION);
-    service->OnRemoteRequest(code, datas, reply, option);
-    service = nullptr;
-    return true;
-}
-
-bool CmdAppendBundlesIncrementalBackupSessionFuzzTest(const uint8_t *data, size_t size)
-{
-    MessageParcel datas;
-    datas.WriteInterfaceToken(ServiceStub::GetDescriptor());
-    if (size >= sizeof(int32_t)) {
-        vector<BIncrementalData> bundleNames;
-        GetBundleNamesData(data, size, bundleNames);
-        WriteParcelableVector(bundleNames, datas);
-    }
-    datas.RewindRead(0);
-    MessageParcel reply;
-    MessageOption option;
-
-    sptr service(new Service(SERVICE_ID));
-    uint32_t code = static_cast<uint32_t>(
-        IServiceIpcCode::COMMAND_APPEND_BUNDLES_INCREMENTAL_BACKUP_SESSION);
-    service->OnRemoteRequest(code, datas, reply, option);
-    service = nullptr;
-    return true;
-}
-
-bool CmdPublishIncrementalFileFuzzTest(const uint8_t *data, size_t size)
-{
-    MessageParcel datas;
-    datas.WriteInterfaceToken(ServiceStub::GetDescriptor());
-    if (size > 0) {
-        int pos = (size + 1) >> 1;
-        std::string fileName(reinterpret_cast<const char *>(data), pos);
-        std::string bundleName(reinterpret_cast<const char *>(data + pos), size - pos);
-        uint32_t sn = 0;
-        if (size > sizeof(uint32_t)) {
-            sn = *(reinterpret_cast<const uint32_t *>(data));
-        }
-        BFileInfo fileInfo(fileName, bundleName, sn);
-        datas.WriteParcelable(&fileInfo);
-    }
-
-    datas.RewindRead(0);
-    MessageParcel reply;
-    MessageOption option;
-
-    sptr service(new Service(SERVICE_ID));
-    uint32_t code = static_cast<uint32_t>(IServiceIpcCode::COMMAND_PUBLISH_INCREMENTAL_FILE);
-    service->OnRemoteRequest(code, datas, reply, option);
-    service = nullptr;
-    return true;
-}
-
-bool CmdAppIncrementalFileReadyFuzzTest(const uint8_t *data, size_t size)
-{
-    MessageParcel datas;
-    datas.WriteInterfaceToken(ServiceStub::GetDescriptor());
-    std::string fileName(reinterpret_cast<const char *>(data), size);
-    datas.WriteString(fileName);
-    if (size >= sizeof(int)) {
-        int fd = *(reinterpret_cast<const int *>(data));
-        datas.WriteFileDescriptor(UniqueFd(fd));
-    }
-
-    if (size >= sizeof(int) + sizeof(int))  {
-        int manifestId = *(reinterpret_cast<const int *>(data + sizeof(int)));
-        datas.WriteFileDescriptor(UniqueFd(manifestId));
-    }
-    datas.RewindRead(0);
-    MessageParcel reply;
-    MessageOption option;
-
-    sptr service(new Service(SERVICE_ID));
-    uint32_t code = static_cast<uint32_t>(IServiceIpcCode::COMMAND_APP_INCREMENTAL_FILE_READY);
-    service->OnRemoteRequest(code, datas, reply, option);
-    service = nullptr;
-    return true;
-}
-
-bool CmdAppIncrementalDoneFuzzTest(const uint8_t *data, size_t size)
-{
-    MessageParcel datas;
-    datas.WriteInterfaceToken(ServiceStub::GetDescriptor());
-    if (size >= sizeof(int32_t)) {
-        datas.WriteInt32(*(reinterpret_cast<const int32_t *>(data)));
-    }
-
-    datas.RewindRead(0);
-    MessageParcel reply;
-    MessageOption option;
-
-    sptr service(new Service(SERVICE_ID));
-    service->OnRemoteRequest(static_cast<uint32_t>(IServiceIpcCode::COMMAND_APP_INCREMENTAL_DONE),
-        datas, reply, option);
-    service = nullptr;
-    return true;
-}
-
-bool CmdGetIncrementalFileHandleFuzzTest(const uint8_t *data, size_t size)
-{
-    MessageParcel datas;
-    datas.WriteInterfaceToken(ServiceStub::GetDescriptor());
-    int pos = (size + 1) >> 1;
-    if (size > 0) {
-        string param(reinterpret_cast<const char*>(data), pos);
-        datas.WriteString(param);
-    }
-
-    if (size > 1) {
-        string param(reinterpret_cast<const char*>(data + pos), size - pos);
-        datas.WriteString(param);
-    }
-
-    datas.RewindRead(0);
-    MessageParcel reply;
-    MessageOption option;
-
-    sptr service(new Service(SERVICE_ID));
-    service->OnRemoteRequest(static_cast<uint32_t>(IServiceIpcCode::COMMAND_GET_INCREMENTAL_FILE_HANDLE),
-        datas, reply, option);
-    service = nullptr;
-    return true;
-}
-} // namespace OHOS
-
-/* Fuzzer entry point */
-extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
-{
-    OHOS::CmdGetFileHandleFuzzTest(data, size);
-    OHOS::CmdAppendBundlesBackupSessionFuzzTest(data, size);
-    OHOS::CmdReleaseFuzzTest(data, size);
-    OHOS::CmdGetLocalCapabilitiesIncrementalFuzzTest(data, size);
-    OHOS::CmdInitIncrementalBackupSessionFuzzTest(data, size);
-    OHOS::CmdPublishIncrementalFileFuzzTest(data, size);
-    OHOS::CmdAppIncrementalFileReadyFuzzTest(data, size);
-    OHOS::CmdAppIncrementalDoneFuzzTest(data, size);
-    OHOS::CmdGetIncrementalFileHandleFuzzTest(data, size);
-    OHOS::CmdAppendBundlesIncrementalBackupSessionFuzzTest(data, size);
-    return 0;
-}
\ No newline at end of file
diff --git a/test/fuzztest/backupsaanother_fuzzer/BUILD.gn b/test/fuzztest/backupsaappdone_fuzzer/BUILD.gn
similarity index 88%
rename from test/fuzztest/backupsaanother_fuzzer/BUILD.gn
rename to test/fuzztest/backupsaappdone_fuzzer/BUILD.gn
index 36412f43bd770ce6008cb96cf1806a78a79128f8..c2d260e1a720cafcaf920d0be3a4e54c78be12c1 100644
--- a/test/fuzztest/backupsaanother_fuzzer/BUILD.gn
+++ b/test/fuzztest/backupsaappdone_fuzzer/BUILD.gn
@@ -1,4 +1,4 @@
-# Copyright (c) 2024 Huawei Device Co., Ltd.
+# Copyright (c) 2022-2025 Huawei Device Co., Ltd.
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
@@ -18,10 +18,10 @@ import("//foundation/filemanagement/app_file_service/app_file_service.gni")
 import("//foundation/filemanagement/app_file_service/backup.gni")
 
 ##############################fuzztest##########################################
-ohos_fuzztest("BackupSaAnotherFuzzTest") {
+ohos_fuzztest("BackupSaAppDoneFuzzTest") {
   module_out_path = "app_file_service/app_file_service"
   fuzz_config_file =
-      "${app_file_service_path}/test/fuzztest/backupsaanother_fuzzer"
+      "${app_file_service_path}/test/fuzztest/backupsaappdone_fuzzer"
   include_dirs = [
     "${app_file_service_path}/services/backup_sa/include/module_ipc",
     "${app_file_service_path}/services/backup_sa/include",
@@ -34,17 +34,14 @@ ohos_fuzztest("BackupSaAnotherFuzzTest") {
     "-Wno-unused-variable",
     "-fno-omit-frame-pointer",
   ]
-  sources = [ "backupsaanother_fuzzer.cpp" ]
+  sources = [ "backupsaappdone_fuzzer.cpp" ]
 
   deps = [
     "${app_file_service_path}/services/backup_sa:backup_sa",
     "${path_backup}/interfaces/inner_api/native/backup_kit_inner:backup_kit_inner",
-    "${path_backup}/interfaces/innerkits/native:sandbox_helper_native",
     "${path_backup}/utils:backup_utils",
   ]
-
   public_configs = [ "${path_backup}/services/backup_sa:public_idl_config" ]
-
   external_deps = [
     "ability_runtime:ability_manager",
     "ability_runtime:abilitykit_native",
@@ -59,6 +56,7 @@ ohos_fuzztest("BackupSaAnotherFuzzTest") {
   defines = [
     "LOG_TAG=\"app_file_service\"",
     "LOG_DOMAIN=0xD004303",
+    "private=public",
   ]
 
   use_exceptions = true
diff --git a/test/fuzztest/backupsaappdone_fuzzer/backupsaappdone_fuzzer.cpp b/test/fuzztest/backupsaappdone_fuzzer/backupsaappdone_fuzzer.cpp
new file mode 100644
index 0000000000000000000000000000000000000000..c62c0624f3af8297ebe51fe6037ff80dd8ef8c6b
--- /dev/null
+++ b/test/fuzztest/backupsaappdone_fuzzer/backupsaappdone_fuzzer.cpp
@@ -0,0 +1,70 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "backupsaappdone_fuzzer.h"
+
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <climits>
+#include <vector>
+
+#include "message_parcel.h"
+#include "service.h"
+#include "service_proxy.h"
+#include "service_reverse.h"
+#include "service_stub.h"
+#include "securec.h"
+#include "system_ability.h"
+
+using namespace std;
+using namespace OHOS::FileManagement::Backup;
+
+namespace OHOS {
+constexpr int32_t SERVICE_ID = 5203;
+
+bool CmdAppDoneFuzzTest(const uint8_t *data, size_t size)
+{
+    if (data == nullptr || size < sizeof(int32_t)) {
+        return false;
+    }
+    MessageParcel datas;
+    datas.WriteInterfaceToken(ServiceStub::GetDescriptor());
+    int32_t errCode = *(reinterpret_cast<const int32_t *>(data));
+    datas.WriteInt32(errCode);
+    datas.RewindRead(0);
+    MessageParcel reply;
+    MessageOption option;
+
+    sptr service(new Service(SERVICE_ID));
+    service->OnRemoteRequest(static_cast<uint32_t>(IServiceIpcCode::COMMAND_APP_DONE),
+        datas, reply, option);
+    return true;
+}
+} // namespace OHOS
+
+/* Fuzzer entry point */
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+    /* Run your code on data */
+    try {
+        OHOS::CmdAppDoneFuzzTest(data, size);
+    } catch (OHOS::FileManagement::Backup::BError &err) {
+        HILOGE("BackupSaFuzzTest error");
+    } catch (...) {
+        HILOGE("BackupSaFuzzTest exception");
+    }
+    return 0;
+}
\ No newline at end of file
diff --git a/test/fuzztest/backupsaanother_fuzzer/backupsaanother_fuzzer.h b/test/fuzztest/backupsaappdone_fuzzer/backupsaappdone_fuzzer.h
similarity index 77%
rename from test/fuzztest/backupsaanother_fuzzer/backupsaanother_fuzzer.h
rename to test/fuzztest/backupsaappdone_fuzzer/backupsaappdone_fuzzer.h
index f89e351e66d771ee30bc024ed714385ee7e74239..033d71c0db9659b5c3e68c816d5844334ac1bbcc 100644
--- a/test/fuzztest/backupsaanother_fuzzer/backupsaanother_fuzzer.h
+++ b/test/fuzztest/backupsaappdone_fuzzer/backupsaappdone_fuzzer.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2024 Huawei Device Co., Ltd.
+ * Copyright (c) 2022-2025 Huawei Device Co., Ltd.
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
@@ -13,9 +13,9 @@
  * limitations under the License.
  */
 
-#ifndef BACKUPSAANOTHER_FUZZER_H
-#define BACKUPSAANOTHER_FUZZER_H
+#ifndef BACKUPSAAPPDONE_FUZZER_H
+#define BACKUPSAAPPDONE_FUZZER_H
 
-#define FUZZ_PROJECT_NAME "backupsaanother_fuzzer"
+#define FUZZ_PROJECT_NAME "backupsaappdone_fuzzer"
 
 #endif
\ No newline at end of file
diff --git a/test/fuzztest/backupsaappend_fuzzer/corpus/init b/test/fuzztest/backupsaappdone_fuzzer/corpus/init
similarity index 92%
rename from test/fuzztest/backupsaappend_fuzzer/corpus/init
rename to test/fuzztest/backupsaappdone_fuzzer/corpus/init
index 6198079a28e860189d4294f6598f8ac6804c0dff..7ade8a0faafeaedba7241e7d4a97b8e1f9691932 100644
--- a/test/fuzztest/backupsaappend_fuzzer/corpus/init
+++ b/test/fuzztest/backupsaappdone_fuzzer/corpus/init
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2024 Huawei Device Co., Ltd.
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
diff --git a/test/fuzztest/backupsaanother_fuzzer/project.xml b/test/fuzztest/backupsaappdone_fuzzer/project.xml
similarity index 95%
rename from test/fuzztest/backupsaanother_fuzzer/project.xml
rename to test/fuzztest/backupsaappdone_fuzzer/project.xml
index 7133b2b92440904a5ed04b838733acea0f97486a..66e1dcac475475fb101b6f8670ec699e6e9696aa 100644
--- a/test/fuzztest/backupsaanother_fuzzer/project.xml
+++ b/test/fuzztest/backupsaappdone_fuzzer/project.xml
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!-- Copyright (c) 2024 Huawei Device Co., Ltd.
+<!-- Copyright (c) 2025 Huawei Device Co., Ltd.
 
      Licensed under the Apache License, Version 2.0 (the "License");
      you may not use this file except in compliance with the License.
diff --git a/test/fuzztest/backupsaappendbundlesrestoresession_fuzzer/BUILD.gn b/test/fuzztest/backupsaappendbundlesrestoresession_fuzzer/BUILD.gn
new file mode 100644
index 0000000000000000000000000000000000000000..61d72bd322adb1876318bfe53e84dfe15a5b1322
--- /dev/null
+++ b/test/fuzztest/backupsaappendbundlesrestoresession_fuzzer/BUILD.gn
@@ -0,0 +1,64 @@
+# Copyright (c) 2021-2025 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#####################hydra-fuzz###################
+import("//build/config/features.gni")
+import("//build/test.gni")
+import("//foundation/filemanagement/app_file_service/app_file_service.gni")
+import("//foundation/filemanagement/app_file_service/backup.gni")
+
+##############################fuzztest##########################################
+ohos_fuzztest("BackupSaAppendBundlesRestoreSessionFuzzTest") {
+  module_out_path = "app_file_service/app_file_service"
+  fuzz_config_file =
+      "${app_file_service_path}/test/fuzztest/backupsaappendbundlesrestoresession_fuzzer"
+  include_dirs = [
+    "${app_file_service_path}/services/backup_sa/include/module_ipc",
+    "${app_file_service_path}/services/backup_sa/include",
+    "${app_file_service_path}/interfaces/inner_api/native/backup_kit_inner/impl",
+    "${app_file_service_path}/frameworks/native/backup_kit_inner/include",
+  ]
+  cflags = [
+    "-g",
+    "-O0",
+    "-Wno-unused-variable",
+    "-fno-omit-frame-pointer",
+  ]
+  sources = [ "backupsaappendbundlesrestoresession_fuzzer.cpp" ]
+
+  deps = [
+    "${app_file_service_path}/services/backup_sa:backup_sa",
+    "${path_backup}/interfaces/inner_api/native/backup_kit_inner:backup_kit_inner",
+    "${path_backup}/utils:backup_utils",
+  ]
+  public_configs = [ "${path_backup}/services/backup_sa:public_idl_config" ]
+  external_deps = [
+    "ability_runtime:ability_manager",
+    "ability_runtime:abilitykit_native",
+    "bounds_checking_function:libsec_shared",
+    "c_utils:utils",
+    "file_api:filemgmt_libn",
+    "hilog:libhilog",
+    "ipc:ipc_core",
+    "safwk:system_ability_fwk",
+  ]
+
+  defines = [
+    "LOG_TAG=\"app_file_service\"",
+    "LOG_DOMAIN=0xD004303",
+    "private=public",
+  ]
+
+  use_exceptions = true
+}
+###############################################################################
diff --git a/test/fuzztest/backupsaappend_fuzzer/backupsaappend_fuzzer.cpp b/test/fuzztest/backupsaappendbundlesrestoresession_fuzzer/backupsaappendbundlesrestoresession_fuzzer.cpp
similarity index 32%
rename from test/fuzztest/backupsaappend_fuzzer/backupsaappend_fuzzer.cpp
rename to test/fuzztest/backupsaappendbundlesrestoresession_fuzzer/backupsaappendbundlesrestoresession_fuzzer.cpp
index 9a6e46113927a07fb242375553133ee2882cdd70..fca2fc9b3ff15a3fed08ff312377c0ccfb92f7c2 100644
--- a/test/fuzztest/backupsaappend_fuzzer/backupsaappend_fuzzer.cpp
+++ b/test/fuzztest/backupsaappendbundlesrestoresession_fuzzer/backupsaappendbundlesrestoresession_fuzzer.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2024 Huawei Device Co., Ltd.
+ * Copyright (c) 2021-2025 Huawei Device Co., Ltd.
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
@@ -13,7 +13,7 @@
  * limitations under the License.
  */
 
-#include "backupsaappend_fuzzer.h"
+#include "backupsaappendbundlesrestoresession_fuzzer.h"
 
 #include <cstddef>
 #include <cstdint>
@@ -35,154 +35,6 @@ using namespace OHOS::FileManagement::Backup;
 namespace OHOS {
 constexpr int32_t SERVICE_ID = 5203;
 
-bool CmdInitRestoreSessionFuzzTest(const uint8_t *data, size_t size)
-{
-    MessageParcel datas;
-    datas.WriteInterfaceToken(ServiceStub::GetDescriptor());
-    datas.WriteBuffer(data, size);
-    datas.RewindRead(0);
-    MessageParcel reply;
-    MessageOption option;
-
-    sptr service(new Service(SERVICE_ID));
-    service->OnRemoteRequest(static_cast<uint32_t>(IServiceIpcCode::COMMAND_INIT_RESTORE_SESSION),
-        datas, reply, option);
-    service = nullptr;
-    return true;
-}
-
-bool CmdInitBackupSessionFuzzTest(const uint8_t *data, size_t size)
-{
-    MessageParcel datas;
-    datas.WriteInterfaceToken(ServiceStub::GetDescriptor());
-    datas.WriteBuffer(data, size);
-    datas.RewindRead(0);
-    MessageParcel reply;
-    MessageOption option;
-
-    sptr service(new Service(SERVICE_ID));
-    service->OnRemoteRequest(static_cast<uint32_t>(IServiceIpcCode::COMMAND_INIT_BACKUP_SESSION),
-        datas, reply, option);
-    service = nullptr;
-    return true;
-}
-
-bool CmdPublishFileFuzzTest(const uint8_t *data, size_t size)
-{
-    MessageParcel datas;
-    datas.WriteInterfaceToken(ServiceStub::GetDescriptor());
-    if (size > 0) {
-        int pos = (size + 1) >> 1;
-        std::string fileName(reinterpret_cast<const char *>(data), pos);
-        std::string bundleName(reinterpret_cast<const char *>(data + pos), size - pos);
-        uint32_t sn = 0;
-        if (size > sizeof(uint32_t)) {
-            sn = *(reinterpret_cast<const uint32_t *>(data));
-        }
-        BFileInfo fileInfo(fileName, bundleName, sn);
-        datas.WriteParcelable(&fileInfo);
-    }
-    datas.RewindRead(0);
-    MessageParcel reply;
-    MessageOption option;
-
-    sptr service(new Service(SERVICE_ID));
-    service->OnRemoteRequest(static_cast<uint32_t>(IServiceIpcCode::COMMAND_PUBLISH_FILE),
-        datas, reply, option);
-    service = nullptr;
-    return true;
-}
-
-bool CmdGetLocalCapabilitiesFuzzTest(const uint8_t *data, size_t size)
-{
-    MessageParcel datas;
-    datas.WriteInterfaceToken(ServiceStub::GetDescriptor());
-    datas.WriteBuffer(data, size);
-    datas.RewindRead(0);
-    MessageParcel reply;
-    MessageOption option;
-
-    sptr service(new Service(SERVICE_ID));
-    uint32_t code = static_cast<uint32_t>(IServiceIpcCode::COMMAND_GET_LOCAL_CAPABILITIES);
-    service->OnRemoteRequest(code, datas, reply, option);
-    service = nullptr;
-    return true;
-}
-
-bool CmdAppFileReadyFuzzTest(const uint8_t *data, size_t size)
-{
-    MessageParcel datas;
-    datas.WriteInterfaceToken(ServiceStub::GetDescriptor());
-    std::string fileName(reinterpret_cast<const char *>(data), size);
-    datas.WriteString(fileName);
-
-    int fd = -1;
-    if (size >= sizeof(int)) {
-        fd = *(reinterpret_cast<const int *>(data));
-    }
-    datas.WriteFileDescriptor(UniqueFd(fd));
-
-    datas.RewindRead(0);
-    MessageParcel reply;
-    MessageOption option;
-
-    sptr service(new Service(SERVICE_ID));
-    uint32_t code = static_cast<uint32_t>(IServiceIpcCode::COMMAND_APP_FILE_READY);
-    service->OnRemoteRequest(code, datas, reply, option);
-    service = nullptr;
-    return true;
-}
-
-bool CmdAppDoneFuzzTest(const uint8_t *data, size_t size)
-{
-    MessageParcel datas;
-    datas.WriteInterfaceToken(ServiceStub::GetDescriptor());
-    if (size >= sizeof(bool)) {
-        datas.WriteBool(*(reinterpret_cast<const bool *>(data)));
-    }
-    datas.RewindRead(0);
-    MessageParcel reply;
-    MessageOption option;
-
-    sptr service(new Service(SERVICE_ID));
-    service->OnRemoteRequest(static_cast<uint32_t>(IServiceIpcCode::COMMAND_APP_DONE),
-        datas, reply, option);
-    service = nullptr;
-    return true;
-}
-
-bool CmdStartFuzzTest(const uint8_t *data, size_t size)
-{
-    MessageParcel datas;
-    datas.WriteInterfaceToken(ServiceStub::GetDescriptor());
-    datas.WriteBuffer(data, size);
-    datas.RewindRead(0);
-    MessageParcel reply;
-    MessageOption option;
-
-    sptr service(new Service(SERVICE_ID));
-    service->OnRemoteRequest(static_cast<uint32_t>(IServiceIpcCode::COMMAND_START),
-        datas, reply, option);
-    service = nullptr;
-    return true;
-}
-
-bool CmdFinishFuzzTest(const uint8_t *data, size_t size)
-{
-    MessageParcel datas;
-    datas.WriteInterfaceToken(ServiceStub::GetDescriptor());
-    datas.WriteBuffer(data, size);
-    datas.RewindRead(0);
-    MessageParcel reply;
-    MessageOption option;
-
-    sptr service(new Service(SERVICE_ID));
-    service->OnRemoteRequest(static_cast<uint32_t>(IServiceIpcCode::COMMAND_FINISH),
-        datas, reply, option);
-    service = nullptr;
-    return true;
-}
-
 bool CmdAppendBundlesRestoreSessionFuzzTest(const uint8_t *data, size_t size)
 {
     MessageParcel datas;
@@ -221,7 +73,6 @@ bool CmdAppendBundlesRestoreSessionFuzzTest(const uint8_t *data, size_t size)
     sptr service(new Service(SERVICE_ID));
     service->OnRemoteRequest(static_cast<uint32_t>(IServiceIpcCode::COMMAND_APPEND_BUNDLES_RESTORE_SESSION_DATA),
         datas, reply, option);
-    service = nullptr;
     return true;
 }
 } // namespace OHOS
@@ -230,14 +81,12 @@ bool CmdAppendBundlesRestoreSessionFuzzTest(const uint8_t *data, size_t size)
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
 {
     /* Run your code on data */
-    OHOS::CmdInitRestoreSessionFuzzTest(data, size);
-    OHOS::CmdInitBackupSessionFuzzTest(data, size);
-    OHOS::CmdPublishFileFuzzTest(data, size);
-    OHOS::CmdGetLocalCapabilitiesFuzzTest(data, size);
-    OHOS::CmdAppFileReadyFuzzTest(data, size);
-    OHOS::CmdAppDoneFuzzTest(data, size);
-    OHOS::CmdStartFuzzTest(data, size);
-    OHOS::CmdFinishFuzzTest(data, size);
-    OHOS::CmdAppendBundlesRestoreSessionFuzzTest(data, size);
+    try {
+        OHOS::CmdAppendBundlesRestoreSessionFuzzTest(data, size);
+    } catch (OHOS::FileManagement::Backup::BError &err) {
+        HILOGE("BackupSaFuzzTest error");
+    } catch (...) {
+        HILOGE("BackupSaFuzzTest exception");
+    }
     return 0;
 }
\ No newline at end of file
diff --git a/test/fuzztest/backupsaappendbundlesrestoresession_fuzzer/backupsaappendbundlesrestoresession_fuzzer.h b/test/fuzztest/backupsaappendbundlesrestoresession_fuzzer/backupsaappendbundlesrestoresession_fuzzer.h
new file mode 100644
index 0000000000000000000000000000000000000000..4c1b680a1089f4556ffc832f3d4729b64a066ff4
--- /dev/null
+++ b/test/fuzztest/backupsaappendbundlesrestoresession_fuzzer/backupsaappendbundlesrestoresession_fuzzer.h
@@ -0,0 +1,21 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef BACKUPSAAPPENDBUNDLESRESTORESESSION_FUZZER_H
+#define BACKUPSAAPPENDBUNDLESRESTORESESSION_FUZZER_H
+
+#define FUZZ_PROJECT_NAME "backupsaappendbundlesrestoresession_fuzzer"
+
+#endif
\ No newline at end of file
diff --git a/test/fuzztest/backupsaanother_fuzzer/corpus/init b/test/fuzztest/backupsaappendbundlesrestoresession_fuzzer/corpus/init
similarity index 92%
rename from test/fuzztest/backupsaanother_fuzzer/corpus/init
rename to test/fuzztest/backupsaappendbundlesrestoresession_fuzzer/corpus/init
index 6198079a28e860189d4294f6598f8ac6804c0dff..7ade8a0faafeaedba7241e7d4a97b8e1f9691932 100644
--- a/test/fuzztest/backupsaanother_fuzzer/corpus/init
+++ b/test/fuzztest/backupsaappendbundlesrestoresession_fuzzer/corpus/init
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2024 Huawei Device Co., Ltd.
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
diff --git a/test/fuzztest/backupsaappend_fuzzer/project.xml b/test/fuzztest/backupsaappendbundlesrestoresession_fuzzer/project.xml
similarity index 95%
rename from test/fuzztest/backupsaappend_fuzzer/project.xml
rename to test/fuzztest/backupsaappendbundlesrestoresession_fuzzer/project.xml
index 7133b2b92440904a5ed04b838733acea0f97486a..66e1dcac475475fb101b6f8670ec699e6e9696aa 100644
--- a/test/fuzztest/backupsaappend_fuzzer/project.xml
+++ b/test/fuzztest/backupsaappendbundlesrestoresession_fuzzer/project.xml
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<!-- Copyright (c) 2024 Huawei Device Co., Ltd.
+<!-- Copyright (c) 2025 Huawei Device Co., Ltd.
 
      Licensed under the Apache License, Version 2.0 (the "License");
      you may not use this file except in compliance with the License.
diff --git a/test/fuzztest/backupsaappfileready_fuzzer/BUILD.gn b/test/fuzztest/backupsaappfileready_fuzzer/BUILD.gn
new file mode 100644
index 0000000000000000000000000000000000000000..9b027583fca4eedfc1d37b73d520e7b56455a34a
--- /dev/null
+++ b/test/fuzztest/backupsaappfileready_fuzzer/BUILD.gn
@@ -0,0 +1,64 @@
+# Copyright (c) 2021-2025 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#####################hydra-fuzz###################
+import("//build/config/features.gni")
+import("//build/test.gni")
+import("//foundation/filemanagement/app_file_service/app_file_service.gni")
+import("//foundation/filemanagement/app_file_service/backup.gni")
+
+##############################fuzztest##########################################
+ohos_fuzztest("BackupSaAppFileReadyFuzzTest") {
+  module_out_path = "app_file_service/app_file_service"
+  fuzz_config_file =
+      "${app_file_service_path}/test/fuzztest/backupsaappfileready_fuzzer"
+  include_dirs = [
+    "${app_file_service_path}/services/backup_sa/include/module_ipc",
+    "${app_file_service_path}/services/backup_sa/include",
+    "${app_file_service_path}/interfaces/inner_api/native/backup_kit_inner/impl",
+    "${app_file_service_path}/frameworks/native/backup_kit_inner/include",
+  ]
+  cflags = [
+    "-g",
+    "-O0",
+    "-Wno-unused-variable",
+    "-fno-omit-frame-pointer",
+  ]
+  sources = [ "backupsaappfileready_fuzzer.cpp" ]
+
+  deps = [
+    "${app_file_service_path}/services/backup_sa:backup_sa",
+    "${path_backup}/interfaces/inner_api/native/backup_kit_inner:backup_kit_inner",
+    "${path_backup}/utils:backup_utils",
+  ]
+  public_configs = [ "${path_backup}/services/backup_sa:public_idl_config" ]
+  external_deps = [
+    "ability_runtime:ability_manager",
+    "ability_runtime:abilitykit_native",
+    "bounds_checking_function:libsec_shared",
+    "c_utils:utils",
+    "file_api:filemgmt_libn",
+    "hilog:libhilog",
+    "ipc:ipc_core",
+    "safwk:system_ability_fwk",
+  ]
+
+  defines = [
+    "LOG_TAG=\"app_file_service\"",
+    "LOG_DOMAIN=0xD004303",
+    "private=public",
+  ]
+
+  use_exceptions = true
+}
+###############################################################################
diff --git a/test/fuzztest/backupsaappfileready_fuzzer/backupsaappfileready_fuzzer.cpp b/test/fuzztest/backupsaappfileready_fuzzer/backupsaappfileready_fuzzer.cpp
new file mode 100644
index 0000000000000000000000000000000000000000..ad76fb640e0f2e0a2b57955cf5b034ee56747ad9
--- /dev/null
+++ b/test/fuzztest/backupsaappfileready_fuzzer/backupsaappfileready_fuzzer.cpp
@@ -0,0 +1,74 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "backupsaappfileready_fuzzer.h"
+
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <climits>
+#include <vector>
+
+#include "message_parcel.h"
+#include "service.h"
+#include "service_proxy.h"
+#include "service_reverse.h"
+#include "service_stub.h"
+#include "securec.h"
+#include "system_ability.h"
+
+using namespace std;
+using namespace OHOS::FileManagement::Backup;
+
+namespace OHOS {
+constexpr int32_t SERVICE_ID = 5203;
+
+bool CmdAppFileReadyFuzzTest(const uint8_t *data, size_t size)
+{
+    MessageParcel datas;
+    datas.WriteInterfaceToken(ServiceStub::GetDescriptor());
+    std::string fileName(reinterpret_cast<const char *>(data), size);
+    datas.WriteString(fileName);
+
+    int fd = -1;
+    if (size >= sizeof(int)) {
+        fd = *(reinterpret_cast<const int *>(data));
+    }
+    datas.WriteFileDescriptor(UniqueFd(fd));
+
+    datas.RewindRead(0);
+    MessageParcel reply;
+    MessageOption option;
+
+    sptr service(new Service(SERVICE_ID));
+    uint32_t code = static_cast<uint32_t>(IServiceIpcCode::COMMAND_APP_FILE_READY);
+    service->OnRemoteRequest(code, datas, reply, option);
+    return true;
+}
+} // namespace OHOS
+
+/* Fuzzer entry point */
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+    /* Run your code on data */
+    try {
+        OHOS::CmdAppFileReadyFuzzTest(data, size);
+    } catch (OHOS::FileManagement::Backup::BError &err) {
+        HILOGE("BackupSaFuzzTest error");
+    } catch (...) {
+        HILOGE("BackupSaFuzzTest exception");
+    }
+    return 0;
+}
\ No newline at end of file
diff --git a/test/fuzztest/backupsaappfileready_fuzzer/backupsaappfileready_fuzzer.h b/test/fuzztest/backupsaappfileready_fuzzer/backupsaappfileready_fuzzer.h
new file mode 100644
index 0000000000000000000000000000000000000000..6fbc9e6b7d96a5b653aaf2162608b131279721f5
--- /dev/null
+++ b/test/fuzztest/backupsaappfileready_fuzzer/backupsaappfileready_fuzzer.h
@@ -0,0 +1,21 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef BACKUPSAAPPFILEREADY_FUZZER_H
+#define BACKUPSAAPPFILEREADY_FUZZER_H
+
+#define FUZZ_PROJECT_NAME "backupsaappfileready_fuzzer"
+
+#endif
\ No newline at end of file
diff --git a/test/fuzztest/backupsaappfileready_fuzzer/corpus/init b/test/fuzztest/backupsaappfileready_fuzzer/corpus/init
new file mode 100644
index 0000000000000000000000000000000000000000..7ade8a0faafeaedba7241e7d4a97b8e1f9691932
--- /dev/null
+++ b/test/fuzztest/backupsaappfileready_fuzzer/corpus/init
@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+FUZZ
\ No newline at end of file
diff --git a/test/fuzztest/backupsaappfileready_fuzzer/project.xml b/test/fuzztest/backupsaappfileready_fuzzer/project.xml
new file mode 100644
index 0000000000000000000000000000000000000000..66e1dcac475475fb101b6f8670ec699e6e9696aa
--- /dev/null
+++ b/test/fuzztest/backupsaappfileready_fuzzer/project.xml
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (c) 2025 Huawei Device Co., Ltd.
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<fuzz_config>
+  <fuzztest>
+    <!-- maximum length of a test input -->
+    <max_len>1000</max_len>
+    <!-- maximum total time in seconds to run the fuzzer -->
+    <max_total_time>300</max_total_time>
+    <!-- memory usage limit in Mb -->
+    <rss_limit_mb>4096</rss_limit_mb>
+  </fuzztest>
+</fuzz_config>
diff --git a/test/fuzztest/backupsaappend_fuzzer/BUILD.gn b/test/fuzztest/backupsafinish_fuzzer/BUILD.gn
similarity index 90%
rename from test/fuzztest/backupsaappend_fuzzer/BUILD.gn
rename to test/fuzztest/backupsafinish_fuzzer/BUILD.gn
index 410ead2a27573f5b26ef45e0eac52f0b52156143..aa1328aa7583d37484621de5aa35fe306305de6e 100644
--- a/test/fuzztest/backupsaappend_fuzzer/BUILD.gn
+++ b/test/fuzztest/backupsafinish_fuzzer/BUILD.gn
@@ -1,4 +1,4 @@
-# Copyright (c) 2021-2024 Huawei Device Co., Ltd.
+# Copyright (c) 2021-2025 Huawei Device Co., Ltd.
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
@@ -18,10 +18,10 @@ import("//foundation/filemanagement/app_file_service/app_file_service.gni")
 import("//foundation/filemanagement/app_file_service/backup.gni")
 
 ##############################fuzztest##########################################
-ohos_fuzztest("BackupSaAppendFuzzTest") {
+ohos_fuzztest("BackupSaFinishFuzzTest") {
   module_out_path = "app_file_service/app_file_service"
   fuzz_config_file =
-      "${app_file_service_path}/test/fuzztest/backupsaappend_fuzzer"
+      "${app_file_service_path}/test/fuzztest/backupsafinish_fuzzer"
   include_dirs = [
     "${app_file_service_path}/services/backup_sa/include/module_ipc",
     "${app_file_service_path}/services/backup_sa/include",
@@ -34,7 +34,7 @@ ohos_fuzztest("BackupSaAppendFuzzTest") {
     "-Wno-unused-variable",
     "-fno-omit-frame-pointer",
   ]
-  sources = [ "backupsaappend_fuzzer.cpp" ]
+  sources = [ "backupsafinish_fuzzer.cpp" ]
 
   deps = [
     "${app_file_service_path}/services/backup_sa:backup_sa",
@@ -58,5 +58,7 @@ ohos_fuzztest("BackupSaAppendFuzzTest") {
     "LOG_DOMAIN=0xD004303",
     "private=public",
   ]
+
+  use_exceptions = true
 }
 ###############################################################################
diff --git a/test/fuzztest/backupsafinish_fuzzer/backupsafinish_fuzzer.cpp b/test/fuzztest/backupsafinish_fuzzer/backupsafinish_fuzzer.cpp
new file mode 100644
index 0000000000000000000000000000000000000000..0785ebd6a423ad91d0a5b00fb08ddb144c8f21d6
--- /dev/null
+++ b/test/fuzztest/backupsafinish_fuzzer/backupsafinish_fuzzer.cpp
@@ -0,0 +1,65 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "backupsafinish_fuzzer.h"
+
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <climits>
+#include <vector>
+
+#include "message_parcel.h"
+#include "service.h"
+#include "service_proxy.h"
+#include "service_reverse.h"
+#include "service_stub.h"
+#include "securec.h"
+#include "system_ability.h"
+
+using namespace std;
+using namespace OHOS::FileManagement::Backup;
+
+namespace OHOS {
+constexpr int32_t SERVICE_ID = 5203;
+bool CmdFinishFuzzTest(const uint8_t *data, size_t size)
+{
+    MessageParcel datas;
+    datas.WriteInterfaceToken(ServiceStub::GetDescriptor());
+    datas.WriteBuffer(data, size);
+    datas.RewindRead(0);
+    MessageParcel reply;
+    MessageOption option;
+
+    sptr service(new Service(SERVICE_ID));
+    service->OnRemoteRequest(static_cast<uint32_t>(IServiceIpcCode::COMMAND_FINISH),
+        datas, reply, option);
+    return true;
+}
+} // namespace OHOS
+
+/* Fuzzer entry point */
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+    /* Run your code on data */
+    try {
+        OHOS::CmdFinishFuzzTest(data, size);
+    } catch (OHOS::FileManagement::Backup::BError &err) {
+        HILOGE("BackupSaFuzzTest error");
+    } catch (...) {
+        HILOGE("BackupSaFuzzTest exception");
+    }
+    return 0;
+}
\ No newline at end of file
diff --git a/test/fuzztest/backupsafinish_fuzzer/backupsafinish_fuzzer.h b/test/fuzztest/backupsafinish_fuzzer/backupsafinish_fuzzer.h
new file mode 100644
index 0000000000000000000000000000000000000000..8191a46424602c2354e125827ae2d4c537032306
--- /dev/null
+++ b/test/fuzztest/backupsafinish_fuzzer/backupsafinish_fuzzer.h
@@ -0,0 +1,21 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef BACKUPSAFINISHFUZZ_FUZZER_H
+#define BACKUPSAFINISHFUZZ_FUZZER_H
+
+#define FUZZ_PROJECT_NAME "backupsafinish_fuzzer"
+
+#endif
\ No newline at end of file
diff --git a/test/fuzztest/backupsafinish_fuzzer/corpus/init b/test/fuzztest/backupsafinish_fuzzer/corpus/init
new file mode 100644
index 0000000000000000000000000000000000000000..7ade8a0faafeaedba7241e7d4a97b8e1f9691932
--- /dev/null
+++ b/test/fuzztest/backupsafinish_fuzzer/corpus/init
@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+FUZZ
\ No newline at end of file
diff --git a/test/fuzztest/backupsafinish_fuzzer/project.xml b/test/fuzztest/backupsafinish_fuzzer/project.xml
new file mode 100644
index 0000000000000000000000000000000000000000..66e1dcac475475fb101b6f8670ec699e6e9696aa
--- /dev/null
+++ b/test/fuzztest/backupsafinish_fuzzer/project.xml
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (c) 2025 Huawei Device Co., Ltd.
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<fuzz_config>
+  <fuzztest>
+    <!-- maximum length of a test input -->
+    <max_len>1000</max_len>
+    <!-- maximum total time in seconds to run the fuzzer -->
+    <max_total_time>300</max_total_time>
+    <!-- memory usage limit in Mb -->
+    <rss_limit_mb>4096</rss_limit_mb>
+  </fuzztest>
+</fuzz_config>
diff --git a/test/fuzztest/backupsagetlocalcapabilities_fuzzer/BUILD.gn b/test/fuzztest/backupsagetlocalcapabilities_fuzzer/BUILD.gn
new file mode 100644
index 0000000000000000000000000000000000000000..7bc3a73ca3d3bb6e24c4c749a87f6b0bdbcd8023
--- /dev/null
+++ b/test/fuzztest/backupsagetlocalcapabilities_fuzzer/BUILD.gn
@@ -0,0 +1,64 @@
+# Copyright (c) 2021-2025 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#####################hydra-fuzz###################
+import("//build/config/features.gni")
+import("//build/test.gni")
+import("//foundation/filemanagement/app_file_service/app_file_service.gni")
+import("//foundation/filemanagement/app_file_service/backup.gni")
+
+##############################fuzztest##########################################
+ohos_fuzztest("BackupSaGetLocalCapabilitiesFuzzTest") {
+  module_out_path = "app_file_service/app_file_service"
+  fuzz_config_file =
+      "${app_file_service_path}/test/fuzztest/backupsagetlocalcapabilities_fuzzer"
+  include_dirs = [
+    "${app_file_service_path}/services/backup_sa/include/module_ipc",
+    "${app_file_service_path}/services/backup_sa/include",
+    "${app_file_service_path}/interfaces/inner_api/native/backup_kit_inner/impl",
+    "${app_file_service_path}/frameworks/native/backup_kit_inner/include",
+  ]
+  cflags = [
+    "-g",
+    "-O0",
+    "-Wno-unused-variable",
+    "-fno-omit-frame-pointer",
+  ]
+  sources = [ "backupsagetlocalcapabilities_fuzzer.cpp" ]
+
+  deps = [
+    "${app_file_service_path}/services/backup_sa:backup_sa",
+    "${path_backup}/interfaces/inner_api/native/backup_kit_inner:backup_kit_inner",
+    "${path_backup}/utils:backup_utils",
+  ]
+  public_configs = [ "${path_backup}/services/backup_sa:public_idl_config" ]
+  external_deps = [
+    "ability_runtime:ability_manager",
+    "ability_runtime:abilitykit_native",
+    "bounds_checking_function:libsec_shared",
+    "c_utils:utils",
+    "file_api:filemgmt_libn",
+    "hilog:libhilog",
+    "ipc:ipc_core",
+    "safwk:system_ability_fwk",
+  ]
+
+  defines = [
+    "LOG_TAG=\"app_file_service\"",
+    "LOG_DOMAIN=0xD004303",
+    "private=public",
+  ]
+
+  use_exceptions = true
+}
+###############################################################################
diff --git a/test/fuzztest/backupsagetlocalcapabilities_fuzzer/backupsagetlocalcapabilities_fuzzer.cpp b/test/fuzztest/backupsagetlocalcapabilities_fuzzer/backupsagetlocalcapabilities_fuzzer.cpp
new file mode 100644
index 0000000000000000000000000000000000000000..4db07727610c3b2930f3eed28b2900e4458ad82d
--- /dev/null
+++ b/test/fuzztest/backupsagetlocalcapabilities_fuzzer/backupsagetlocalcapabilities_fuzzer.cpp
@@ -0,0 +1,66 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "backupsagetlocalcapabilities_fuzzer.h"
+
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <climits>
+#include <vector>
+
+#include "message_parcel.h"
+#include "service.h"
+#include "service_proxy.h"
+#include "service_reverse.h"
+#include "service_stub.h"
+#include "securec.h"
+#include "system_ability.h"
+
+using namespace std;
+using namespace OHOS::FileManagement::Backup;
+
+namespace OHOS {
+constexpr int32_t SERVICE_ID = 5203;
+
+bool CmdGetLocalCapabilitiesFuzzTest(const uint8_t *data, size_t size)
+{
+    MessageParcel datas;
+    datas.WriteInterfaceToken(ServiceStub::GetDescriptor());
+    datas.WriteBuffer(data, size);
+    datas.RewindRead(0);
+    MessageParcel reply;
+    MessageOption option;
+
+    sptr service(new Service(SERVICE_ID));
+    uint32_t code = static_cast<uint32_t>(IServiceIpcCode::COMMAND_GET_LOCAL_CAPABILITIES);
+    service->OnRemoteRequest(code, datas, reply, option);
+    return true;
+}
+} // namespace OHOS
+
+/* Fuzzer entry point */
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+    /* Run your code on data */
+    try {
+        OHOS::CmdGetLocalCapabilitiesFuzzTest(data, size);
+    } catch (OHOS::FileManagement::Backup::BError &err) {
+        HILOGE("BackupSaFuzzTest error");
+    } catch (...) {
+        HILOGE("BackupSaFuzzTest exception");
+    }
+    return 0;
+}
\ No newline at end of file
diff --git a/test/fuzztest/backupsagetlocalcapabilities_fuzzer/backupsagetlocalcapabilities_fuzzer.h b/test/fuzztest/backupsagetlocalcapabilities_fuzzer/backupsagetlocalcapabilities_fuzzer.h
new file mode 100644
index 0000000000000000000000000000000000000000..61e1af185d94a2eec27dc844649cc60223a7b0bc
--- /dev/null
+++ b/test/fuzztest/backupsagetlocalcapabilities_fuzzer/backupsagetlocalcapabilities_fuzzer.h
@@ -0,0 +1,21 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef BACKUPSAGETLOCALCAPABILITIES_FUZZER_H
+#define BACKUPSAGETLOCALCAPABILITIES_FUZZER_H
+
+#define FUZZ_PROJECT_NAME "backupsagetlocalcapabilities_fuzzer"
+
+#endif
\ No newline at end of file
diff --git a/test/fuzztest/backupsagetlocalcapabilities_fuzzer/corpus/init b/test/fuzztest/backupsagetlocalcapabilities_fuzzer/corpus/init
new file mode 100644
index 0000000000000000000000000000000000000000..7ade8a0faafeaedba7241e7d4a97b8e1f9691932
--- /dev/null
+++ b/test/fuzztest/backupsagetlocalcapabilities_fuzzer/corpus/init
@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+FUZZ
\ No newline at end of file
diff --git a/test/fuzztest/backupsagetlocalcapabilities_fuzzer/project.xml b/test/fuzztest/backupsagetlocalcapabilities_fuzzer/project.xml
new file mode 100644
index 0000000000000000000000000000000000000000..66e1dcac475475fb101b6f8670ec699e6e9696aa
--- /dev/null
+++ b/test/fuzztest/backupsagetlocalcapabilities_fuzzer/project.xml
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (c) 2025 Huawei Device Co., Ltd.
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<fuzz_config>
+  <fuzztest>
+    <!-- maximum length of a test input -->
+    <max_len>1000</max_len>
+    <!-- maximum total time in seconds to run the fuzzer -->
+    <max_total_time>300</max_total_time>
+    <!-- memory usage limit in Mb -->
+    <rss_limit_mb>4096</rss_limit_mb>
+  </fuzztest>
+</fuzz_config>
diff --git a/test/fuzztest/backupsainitbackupsession_fuzzer/BUILD.gn b/test/fuzztest/backupsainitbackupsession_fuzzer/BUILD.gn
new file mode 100644
index 0000000000000000000000000000000000000000..64168d4e5330e30f05133969fd43a59cee471b59
--- /dev/null
+++ b/test/fuzztest/backupsainitbackupsession_fuzzer/BUILD.gn
@@ -0,0 +1,64 @@
+# Copyright (c) 2021-2025 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#####################hydra-fuzz###################
+import("//build/config/features.gni")
+import("//build/test.gni")
+import("//foundation/filemanagement/app_file_service/app_file_service.gni")
+import("//foundation/filemanagement/app_file_service/backup.gni")
+
+##############################fuzztest##########################################
+ohos_fuzztest("BackupSaInitBackupSessionFuzzTest") {
+  module_out_path = "app_file_service/app_file_service"
+  fuzz_config_file =
+      "${app_file_service_path}/test/fuzztest/backupsainitbackupsession_fuzzer"
+  include_dirs = [
+    "${app_file_service_path}/services/backup_sa/include/module_ipc",
+    "${app_file_service_path}/services/backup_sa/include",
+    "${app_file_service_path}/interfaces/inner_api/native/backup_kit_inner/impl",
+    "${app_file_service_path}/frameworks/native/backup_kit_inner/include",
+  ]
+  cflags = [
+    "-g",
+    "-O0",
+    "-Wno-unused-variable",
+    "-fno-omit-frame-pointer",
+  ]
+  sources = [ "backupsainitbackupsession_fuzzer.cpp" ]
+
+  deps = [
+    "${app_file_service_path}/services/backup_sa:backup_sa",
+    "${path_backup}/interfaces/inner_api/native/backup_kit_inner:backup_kit_inner",
+    "${path_backup}/utils:backup_utils",
+  ]
+  public_configs = [ "${path_backup}/services/backup_sa:public_idl_config" ]
+  external_deps = [
+    "ability_runtime:ability_manager",
+    "ability_runtime:abilitykit_native",
+    "bounds_checking_function:libsec_shared",
+    "c_utils:utils",
+    "file_api:filemgmt_libn",
+    "hilog:libhilog",
+    "ipc:ipc_core",
+    "safwk:system_ability_fwk",
+  ]
+
+  defines = [
+    "LOG_TAG=\"app_file_service\"",
+    "LOG_DOMAIN=0xD004303",
+    "private=public",
+  ]
+
+  use_exceptions = true
+}
+###############################################################################
diff --git a/test/fuzztest/backupsainitbackupsession_fuzzer/backupsainitbackupsession_fuzzer.cpp b/test/fuzztest/backupsainitbackupsession_fuzzer/backupsainitbackupsession_fuzzer.cpp
new file mode 100644
index 0000000000000000000000000000000000000000..5ac3b7af74ff25b722f4079b1e5cc00264007f59
--- /dev/null
+++ b/test/fuzztest/backupsainitbackupsession_fuzzer/backupsainitbackupsession_fuzzer.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "backupsainitbackupsession_fuzzer.h"
+
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <climits>
+#include <vector>
+
+#include "message_parcel.h"
+#include "service.h"
+#include "service_proxy.h"
+#include "service_reverse.h"
+#include "service_stub.h"
+#include "securec.h"
+#include "system_ability.h"
+
+using namespace std;
+using namespace OHOS::FileManagement::Backup;
+
+namespace OHOS {
+constexpr int32_t SERVICE_ID = 5203;
+
+bool CmdInitBackupSessionFuzzTest(const uint8_t *data, size_t size)
+{
+    MessageParcel datas;
+    datas.WriteInterfaceToken(ServiceStub::GetDescriptor());
+    datas.WriteBuffer(data, size);
+    datas.RewindRead(0);
+    MessageParcel reply;
+    MessageOption option;
+
+    sptr service(new Service(SERVICE_ID));
+    service->OnRemoteRequest(static_cast<uint32_t>(IServiceIpcCode::COMMAND_INIT_BACKUP_SESSION),
+        datas, reply, option);
+    service = nullptr;
+    return true;
+}
+} // namespace OHOS
+
+/* Fuzzer entry point */
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+    /* Run your code on data */
+    try {
+        OHOS::CmdInitBackupSessionFuzzTest(data, size);
+    } catch (OHOS::FileManagement::Backup::BError &err) {
+        HILOGE("BackupSaFuzzTest error");
+    } catch (...) {
+        HILOGE("BackupSaFuzzTest exception");
+    }
+    return 0;
+}
\ No newline at end of file
diff --git a/test/fuzztest/backupsainitbackupsession_fuzzer/backupsainitbackupsession_fuzzer.h b/test/fuzztest/backupsainitbackupsession_fuzzer/backupsainitbackupsession_fuzzer.h
new file mode 100644
index 0000000000000000000000000000000000000000..117776b31acb7b65a6cb0ff8a860f5fb0af46632
--- /dev/null
+++ b/test/fuzztest/backupsainitbackupsession_fuzzer/backupsainitbackupsession_fuzzer.h
@@ -0,0 +1,21 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef BACKUPSAINITBACKUPSESSION_FUZZER_H
+#define BACKUPSAINITBACKUPSESSION_FUZZER_H
+
+#define FUZZ_PROJECT_NAME "backupsainitbackupsession_fuzzer"
+
+#endif
\ No newline at end of file
diff --git a/test/fuzztest/backupsainitbackupsession_fuzzer/corpus/init b/test/fuzztest/backupsainitbackupsession_fuzzer/corpus/init
new file mode 100644
index 0000000000000000000000000000000000000000..7ade8a0faafeaedba7241e7d4a97b8e1f9691932
--- /dev/null
+++ b/test/fuzztest/backupsainitbackupsession_fuzzer/corpus/init
@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+FUZZ
\ No newline at end of file
diff --git a/test/fuzztest/backupsainitbackupsession_fuzzer/project.xml b/test/fuzztest/backupsainitbackupsession_fuzzer/project.xml
new file mode 100644
index 0000000000000000000000000000000000000000..66e1dcac475475fb101b6f8670ec699e6e9696aa
--- /dev/null
+++ b/test/fuzztest/backupsainitbackupsession_fuzzer/project.xml
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (c) 2025 Huawei Device Co., Ltd.
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<fuzz_config>
+  <fuzztest>
+    <!-- maximum length of a test input -->
+    <max_len>1000</max_len>
+    <!-- maximum total time in seconds to run the fuzzer -->
+    <max_total_time>300</max_total_time>
+    <!-- memory usage limit in Mb -->
+    <rss_limit_mb>4096</rss_limit_mb>
+  </fuzztest>
+</fuzz_config>
diff --git a/test/fuzztest/backupsainitrestoresession_fuzzer/BUILD.gn b/test/fuzztest/backupsainitrestoresession_fuzzer/BUILD.gn
new file mode 100644
index 0000000000000000000000000000000000000000..2961ddd9efc6f3ffb5dfe7cdd49c6fe4de778089
--- /dev/null
+++ b/test/fuzztest/backupsainitrestoresession_fuzzer/BUILD.gn
@@ -0,0 +1,64 @@
+# Copyright (c) 2021-2025 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#####################hydra-fuzz###################
+import("//build/config/features.gni")
+import("//build/test.gni")
+import("//foundation/filemanagement/app_file_service/app_file_service.gni")
+import("//foundation/filemanagement/app_file_service/backup.gni")
+
+##############################fuzztest##########################################
+ohos_fuzztest("BackupSaInitRestoreSessionFuzzTest") {
+  module_out_path = "app_file_service/app_file_service"
+  fuzz_config_file =
+      "${app_file_service_path}/test/fuzztest/backupsainitrestoresession_fuzzer"
+  include_dirs = [
+    "${app_file_service_path}/services/backup_sa/include/module_ipc",
+    "${app_file_service_path}/services/backup_sa/include",
+    "${app_file_service_path}/interfaces/inner_api/native/backup_kit_inner/impl",
+    "${app_file_service_path}/frameworks/native/backup_kit_inner/include",
+  ]
+  cflags = [
+    "-g",
+    "-O0",
+    "-Wno-unused-variable",
+    "-fno-omit-frame-pointer",
+  ]
+  sources = [ "backupsainitrestoresession_fuzzer.cpp" ]
+
+  deps = [
+    "${app_file_service_path}/services/backup_sa:backup_sa",
+    "${path_backup}/interfaces/inner_api/native/backup_kit_inner:backup_kit_inner",
+    "${path_backup}/utils:backup_utils",
+  ]
+  public_configs = [ "${path_backup}/services/backup_sa:public_idl_config" ]
+  external_deps = [
+    "ability_runtime:ability_manager",
+    "ability_runtime:abilitykit_native",
+    "bounds_checking_function:libsec_shared",
+    "c_utils:utils",
+    "file_api:filemgmt_libn",
+    "hilog:libhilog",
+    "ipc:ipc_core",
+    "safwk:system_ability_fwk",
+  ]
+
+  defines = [
+    "LOG_TAG=\"app_file_service\"",
+    "LOG_DOMAIN=0xD004303",
+    "private=public",
+  ]
+
+  use_exceptions = true
+}
+###############################################################################
diff --git a/test/fuzztest/backupsainitrestoresession_fuzzer/backupsainitrestoresession_fuzzer.cpp b/test/fuzztest/backupsainitrestoresession_fuzzer/backupsainitrestoresession_fuzzer.cpp
new file mode 100644
index 0000000000000000000000000000000000000000..f5adc5aa2ef4df327f071d7011af30bfb90af47c
--- /dev/null
+++ b/test/fuzztest/backupsainitrestoresession_fuzzer/backupsainitrestoresession_fuzzer.cpp
@@ -0,0 +1,66 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "backupsainitrestoresession_fuzzer.h"
+
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <climits>
+#include <vector>
+
+#include "message_parcel.h"
+#include "service.h"
+#include "service_proxy.h"
+#include "service_reverse.h"
+#include "service_stub.h"
+#include "securec.h"
+#include "system_ability.h"
+
+using namespace std;
+using namespace OHOS::FileManagement::Backup;
+
+namespace OHOS {
+constexpr int32_t SERVICE_ID = 5203;
+
+bool CmdInitRestoreSessionFuzzTest(const uint8_t *data, size_t size)
+{
+    MessageParcel datas;
+    datas.WriteInterfaceToken(ServiceStub::GetDescriptor());
+    datas.WriteBuffer(data, size);
+    datas.RewindRead(0);
+    MessageParcel reply;
+    MessageOption option;
+
+    sptr service(new Service(SERVICE_ID));
+    service->OnRemoteRequest(static_cast<uint32_t>(IServiceIpcCode::COMMAND_INIT_RESTORE_SESSION),
+        datas, reply, option);
+    return true;
+}
+} // namespace OHOS
+
+/* Fuzzer entry point */
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+    /* Run your code on data */
+    try {
+        OHOS::CmdInitRestoreSessionFuzzTest(data, size);
+    } catch (OHOS::FileManagement::Backup::BError &err) {
+        HILOGE("BackupSaFuzzTest error");
+    } catch (...) {
+        HILOGE("BackupSaFuzzTest exception");
+    }
+    return 0;
+}
\ No newline at end of file
diff --git a/test/fuzztest/backupsainitrestoresession_fuzzer/backupsainitrestoresession_fuzzer.h b/test/fuzztest/backupsainitrestoresession_fuzzer/backupsainitrestoresession_fuzzer.h
new file mode 100644
index 0000000000000000000000000000000000000000..0b21b9243c3b4f69cbda9181d65b5ff6bed54839
--- /dev/null
+++ b/test/fuzztest/backupsainitrestoresession_fuzzer/backupsainitrestoresession_fuzzer.h
@@ -0,0 +1,21 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef BACKUPSAINITRESTORESESSION_FUZZER_H
+#define BACKUPSAINITRESTORESESSION_FUZZER_H
+
+#define FUZZ_PROJECT_NAME "backupsainitrestoresession_fuzzer"
+
+#endif
\ No newline at end of file
diff --git a/test/fuzztest/backupsainitrestoresession_fuzzer/corpus/init b/test/fuzztest/backupsainitrestoresession_fuzzer/corpus/init
new file mode 100644
index 0000000000000000000000000000000000000000..7ade8a0faafeaedba7241e7d4a97b8e1f9691932
--- /dev/null
+++ b/test/fuzztest/backupsainitrestoresession_fuzzer/corpus/init
@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+FUZZ
\ No newline at end of file
diff --git a/test/fuzztest/backupsainitrestoresession_fuzzer/project.xml b/test/fuzztest/backupsainitrestoresession_fuzzer/project.xml
new file mode 100644
index 0000000000000000000000000000000000000000..66e1dcac475475fb101b6f8670ec699e6e9696aa
--- /dev/null
+++ b/test/fuzztest/backupsainitrestoresession_fuzzer/project.xml
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (c) 2025 Huawei Device Co., Ltd.
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<fuzz_config>
+  <fuzztest>
+    <!-- maximum length of a test input -->
+    <max_len>1000</max_len>
+    <!-- maximum total time in seconds to run the fuzzer -->
+    <max_total_time>300</max_total_time>
+    <!-- memory usage limit in Mb -->
+    <rss_limit_mb>4096</rss_limit_mb>
+  </fuzztest>
+</fuzz_config>
diff --git a/test/fuzztest/backupsapublishfile_fuzzer/BUILD.gn b/test/fuzztest/backupsapublishfile_fuzzer/BUILD.gn
new file mode 100644
index 0000000000000000000000000000000000000000..0dfafe417476b05d3ad750f659addffe659a622e
--- /dev/null
+++ b/test/fuzztest/backupsapublishfile_fuzzer/BUILD.gn
@@ -0,0 +1,64 @@
+# Copyright (c) 2021-2025 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#####################hydra-fuzz###################
+import("//build/config/features.gni")
+import("//build/test.gni")
+import("//foundation/filemanagement/app_file_service/app_file_service.gni")
+import("//foundation/filemanagement/app_file_service/backup.gni")
+
+##############################fuzztest##########################################
+ohos_fuzztest("BackupSaPublishFileFuzzTest") {
+  module_out_path = "app_file_service/app_file_service"
+  fuzz_config_file =
+      "${app_file_service_path}/test/fuzztest/backupsapublishfile_fuzzer"
+  include_dirs = [
+    "${app_file_service_path}/services/backup_sa/include/module_ipc",
+    "${app_file_service_path}/services/backup_sa/include",
+    "${app_file_service_path}/interfaces/inner_api/native/backup_kit_inner/impl",
+    "${app_file_service_path}/frameworks/native/backup_kit_inner/include",
+  ]
+  cflags = [
+    "-g",
+    "-O0",
+    "-Wno-unused-variable",
+    "-fno-omit-frame-pointer",
+  ]
+  sources = [ "backupsapublishfile_fuzzer.cpp" ]
+
+  deps = [
+    "${app_file_service_path}/services/backup_sa:backup_sa",
+    "${path_backup}/interfaces/inner_api/native/backup_kit_inner:backup_kit_inner",
+    "${path_backup}/utils:backup_utils",
+  ]
+  public_configs = [ "${path_backup}/services/backup_sa:public_idl_config" ]
+  external_deps = [
+    "ability_runtime:ability_manager",
+    "ability_runtime:abilitykit_native",
+    "bounds_checking_function:libsec_shared",
+    "c_utils:utils",
+    "file_api:filemgmt_libn",
+    "hilog:libhilog",
+    "ipc:ipc_core",
+    "safwk:system_ability_fwk",
+  ]
+
+  defines = [
+    "LOG_TAG=\"app_file_service\"",
+    "LOG_DOMAIN=0xD004303",
+    "private=public",
+  ]
+
+  use_exceptions = true
+}
+###############################################################################
diff --git a/test/fuzztest/backupsapublishfile_fuzzer/backupsapublishfile_fuzzer.cpp b/test/fuzztest/backupsapublishfile_fuzzer/backupsapublishfile_fuzzer.cpp
new file mode 100644
index 0000000000000000000000000000000000000000..27b6562a23fd062f72b147dc26d8aae941a4686d
--- /dev/null
+++ b/test/fuzztest/backupsapublishfile_fuzzer/backupsapublishfile_fuzzer.cpp
@@ -0,0 +1,74 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "backupsapublishfile_fuzzer.h"
+
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <climits>
+#include <vector>
+
+#include "message_parcel.h"
+#include "service.h"
+#include "service_proxy.h"
+#include "service_reverse.h"
+#include "service_stub.h"
+#include "securec.h"
+#include "system_ability.h"
+
+using namespace std;
+using namespace OHOS::FileManagement::Backup;
+
+namespace OHOS {
+constexpr int32_t SERVICE_ID = 5203;
+
+bool CmdPublishFileFuzzTest(const uint8_t *data, size_t size)
+{
+    if (data == nullptr || size < sizeof(uint32_t)) {
+        return false;
+    }
+    MessageParcel datas;
+    datas.WriteInterfaceToken(ServiceStub::GetDescriptor());
+    uint32_t sn = *(reinterpret_cast<const uint32_t *>(data));
+    int len = (size - sizeof(uint32_t)) >> 1;
+    std::string fileName(reinterpret_cast<const char *>(data + sizeof(uint32_t)), len);
+    std::string bundleName(reinterpret_cast<const char *>(data + sizeof(uint32_t) + len), len);
+    BFileInfo fileInfo(fileName, bundleName, sn);
+    datas.WriteParcelable(&fileInfo);
+    datas.RewindRead(0);
+    MessageParcel reply;
+    MessageOption option;
+
+    sptr service(new Service(SERVICE_ID));
+    service->OnRemoteRequest(static_cast<uint32_t>(IServiceIpcCode::COMMAND_PUBLISH_FILE),
+        datas, reply, option);
+    return true;
+}
+} // namespace OHOS
+
+/* Fuzzer entry point */
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+    /* Run your code on data */
+    try {
+        OHOS::CmdPublishFileFuzzTest(data, size);
+    } catch (OHOS::FileManagement::Backup::BError &err) {
+        HILOGE("BackupSaFuzzTest error");
+    } catch (...) {
+        HILOGE("BackupSaFuzzTest exception");
+    }
+    return 0;
+}
\ No newline at end of file
diff --git a/test/fuzztest/backupsapublishfile_fuzzer/backupsapublishfile_fuzzer.h b/test/fuzztest/backupsapublishfile_fuzzer/backupsapublishfile_fuzzer.h
new file mode 100644
index 0000000000000000000000000000000000000000..38fa27870f696f17e64bbc1eef1c35e654aaa136
--- /dev/null
+++ b/test/fuzztest/backupsapublishfile_fuzzer/backupsapublishfile_fuzzer.h
@@ -0,0 +1,21 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef BACKUPSAPUBLISHFILE_FUZZER_H
+#define BACKUPSAPUBLISHFILE_FUZZER_H
+
+#define FUZZ_PROJECT_NAME "backupsapublishfile_fuzzer"
+
+#endif
\ No newline at end of file
diff --git a/test/fuzztest/backupsapublishfile_fuzzer/corpus/init b/test/fuzztest/backupsapublishfile_fuzzer/corpus/init
new file mode 100644
index 0000000000000000000000000000000000000000..7ade8a0faafeaedba7241e7d4a97b8e1f9691932
--- /dev/null
+++ b/test/fuzztest/backupsapublishfile_fuzzer/corpus/init
@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+FUZZ
\ No newline at end of file
diff --git a/test/fuzztest/backupsapublishfile_fuzzer/project.xml b/test/fuzztest/backupsapublishfile_fuzzer/project.xml
new file mode 100644
index 0000000000000000000000000000000000000000..66e1dcac475475fb101b6f8670ec699e6e9696aa
--- /dev/null
+++ b/test/fuzztest/backupsapublishfile_fuzzer/project.xml
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (c) 2025 Huawei Device Co., Ltd.
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<fuzz_config>
+  <fuzztest>
+    <!-- maximum length of a test input -->
+    <max_len>1000</max_len>
+    <!-- maximum total time in seconds to run the fuzzer -->
+    <max_total_time>300</max_total_time>
+    <!-- memory usage limit in Mb -->
+    <rss_limit_mb>4096</rss_limit_mb>
+  </fuzztest>
+</fuzz_config>
diff --git a/test/fuzztest/backupsastart_fuzzer/BUILD.gn b/test/fuzztest/backupsastart_fuzzer/BUILD.gn
new file mode 100644
index 0000000000000000000000000000000000000000..3299389bbe157cd33cd26d98fd6a01166965e232
--- /dev/null
+++ b/test/fuzztest/backupsastart_fuzzer/BUILD.gn
@@ -0,0 +1,64 @@
+# Copyright (c) 2021-2025 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+#####################hydra-fuzz###################
+import("//build/config/features.gni")
+import("//build/test.gni")
+import("//foundation/filemanagement/app_file_service/app_file_service.gni")
+import("//foundation/filemanagement/app_file_service/backup.gni")
+
+##############################fuzztest##########################################
+ohos_fuzztest("BackupSaStartFuzzTest") {
+  module_out_path = "app_file_service/app_file_service"
+  fuzz_config_file =
+      "${app_file_service_path}/test/fuzztest/backupsastart_fuzzer"
+  include_dirs = [
+    "${app_file_service_path}/services/backup_sa/include/module_ipc",
+    "${app_file_service_path}/services/backup_sa/include",
+    "${app_file_service_path}/interfaces/inner_api/native/backup_kit_inner/impl",
+    "${app_file_service_path}/frameworks/native/backup_kit_inner/include",
+  ]
+  cflags = [
+    "-g",
+    "-O0",
+    "-Wno-unused-variable",
+    "-fno-omit-frame-pointer",
+  ]
+  sources = [ "backupsastart_fuzzer.cpp" ]
+
+  deps = [
+    "${app_file_service_path}/services/backup_sa:backup_sa",
+    "${path_backup}/interfaces/inner_api/native/backup_kit_inner:backup_kit_inner",
+    "${path_backup}/utils:backup_utils",
+  ]
+  public_configs = [ "${path_backup}/services/backup_sa:public_idl_config" ]
+  external_deps = [
+    "ability_runtime:ability_manager",
+    "ability_runtime:abilitykit_native",
+    "bounds_checking_function:libsec_shared",
+    "c_utils:utils",
+    "file_api:filemgmt_libn",
+    "hilog:libhilog",
+    "ipc:ipc_core",
+    "safwk:system_ability_fwk",
+  ]
+
+  defines = [
+    "LOG_TAG=\"app_file_service\"",
+    "LOG_DOMAIN=0xD004303",
+    "private=public",
+  ]
+
+  use_exceptions = true
+}
+###############################################################################
diff --git a/test/fuzztest/backupsastart_fuzzer/backupsastart_fuzzer.cpp b/test/fuzztest/backupsastart_fuzzer/backupsastart_fuzzer.cpp
new file mode 100644
index 0000000000000000000000000000000000000000..ade2f0a21a4579e8bfab4ba891973ddd945fe613
--- /dev/null
+++ b/test/fuzztest/backupsastart_fuzzer/backupsastart_fuzzer.cpp
@@ -0,0 +1,66 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "backupsastart_fuzzer.h"
+
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <climits>
+#include <vector>
+
+#include "message_parcel.h"
+#include "service.h"
+#include "service_proxy.h"
+#include "service_reverse.h"
+#include "service_stub.h"
+#include "securec.h"
+#include "system_ability.h"
+
+using namespace std;
+using namespace OHOS::FileManagement::Backup;
+
+namespace OHOS {
+constexpr int32_t SERVICE_ID = 5203;
+
+bool CmdStartFuzzTest(const uint8_t *data, size_t size)
+{
+    MessageParcel datas;
+    datas.WriteInterfaceToken(ServiceStub::GetDescriptor());
+    datas.WriteBuffer(data, size);
+    datas.RewindRead(0);
+    MessageParcel reply;
+    MessageOption option;
+
+    sptr service(new Service(SERVICE_ID));
+    service->OnRemoteRequest(static_cast<uint32_t>(IServiceIpcCode::COMMAND_START),
+        datas, reply, option);
+    return true;
+}
+} // namespace OHOS
+
+/* Fuzzer entry point */
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
+{
+    /* Run your code on data */
+    try {
+        OHOS::CmdStartFuzzTest(data, size);
+    } catch (OHOS::FileManagement::Backup::BError &err) {
+        HILOGE("BackupSaFuzzTest error");
+    } catch (...) {
+        HILOGE("BackupSaFuzzTest exception");
+    }
+    return 0;
+}
\ No newline at end of file
diff --git a/test/fuzztest/backupsaappend_fuzzer/backupsaappend_fuzzer.h b/test/fuzztest/backupsastart_fuzzer/backupsastart_fuzzer.h
similarity index 77%
rename from test/fuzztest/backupsaappend_fuzzer/backupsaappend_fuzzer.h
rename to test/fuzztest/backupsastart_fuzzer/backupsastart_fuzzer.h
index 8ddfc2126b559d055ee576338bf4e3ca548e75f9..31b627bb586d80e9aa6322c3994ec9cbc2fd586c 100644
--- a/test/fuzztest/backupsaappend_fuzzer/backupsaappend_fuzzer.h
+++ b/test/fuzztest/backupsastart_fuzzer/backupsastart_fuzzer.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2024 Huawei Device Co., Ltd.
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
@@ -13,9 +13,9 @@
  * limitations under the License.
  */
 
-#ifndef BACKUPSAAPPEND_FUZZER_H
-#define BACKUPSAAPPEND_FUZZER_H
+#ifndef BACKUPSASTARTFUZZ_FUZZER_H
+#define BACKUPSASTARTFUZZ_FUZZER_H
 
-#define FUZZ_PROJECT_NAME "backupsaappend_fuzzer"
+#define FUZZ_PROJECT_NAME "backupsastart_fuzzer"
 
 #endif
\ No newline at end of file
diff --git a/test/fuzztest/backupsastart_fuzzer/corpus/init b/test/fuzztest/backupsastart_fuzzer/corpus/init
new file mode 100644
index 0000000000000000000000000000000000000000..7ade8a0faafeaedba7241e7d4a97b8e1f9691932
--- /dev/null
+++ b/test/fuzztest/backupsastart_fuzzer/corpus/init
@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+FUZZ
\ No newline at end of file
diff --git a/test/fuzztest/backupsastart_fuzzer/project.xml b/test/fuzztest/backupsastart_fuzzer/project.xml
new file mode 100644
index 0000000000000000000000000000000000000000..66e1dcac475475fb101b6f8670ec699e6e9696aa
--- /dev/null
+++ b/test/fuzztest/backupsastart_fuzzer/project.xml
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright (c) 2025 Huawei Device Co., Ltd.
+
+     Licensed under the Apache License, Version 2.0 (the "License");
+     you may not use this file except in compliance with the License.
+     You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+     Unless required by applicable law or agreed to in writing, software
+     distributed under the License is distributed on an "AS IS" BASIS,
+     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+     See the License for the specific language governing permissions and
+     limitations under the License.
+-->
+<fuzz_config>
+  <fuzztest>
+    <!-- maximum length of a test input -->
+    <max_len>1000</max_len>
+    <!-- maximum total time in seconds to run the fuzzer -->
+    <max_total_time>300</max_total_time>
+    <!-- memory usage limit in Mb -->
+    <rss_limit_mb>4096</rss_limit_mb>
+  </fuzztest>
+</fuzz_config>
diff --git a/test/fuzztest/servicereverse_fuzzer/servicereverse_fuzzer.cpp b/test/fuzztest/servicereverse_fuzzer/servicereverse_fuzzer.cpp
index 09767b6eea6e4e70c82ee571c0a0664e558534b8..8f9b3cb143ed5fb5dacfb7276a132ed59b5959c4 100644
--- a/test/fuzztest/servicereverse_fuzzer/servicereverse_fuzzer.cpp
+++ b/test/fuzztest/servicereverse_fuzzer/servicereverse_fuzzer.cpp
@@ -657,16 +657,19 @@ bool IncrementalRestoreOnProcessInfoFuzzTest(sptr<ServiceReverse> service, const
 
 bool OnRemoteRequestFuzzTest(sptr<ServiceReverse> service, const uint8_t *data, size_t size)
 {
-    uint32_t codeMax = 26;
+    uint32_t codeMax = 31;
     for (uint32_t code = 1; code < codeMax; code++) {
         MessageParcel datas;
         MessageParcel reply;
         MessageOption option;
-
         datas.WriteInterfaceToken(ServiceReverseStub::GetDescriptor());
         datas.WriteBuffer(reinterpret_cast<const char*>(data), size);
         datas.RewindRead(0);
-        service->OnRemoteRequest(code, datas, reply, option);
+        try {
+            service->OnRemoteRequest(code, datas, reply, option);
+        } catch (BError &err) {
+            // Only filter BError errors, Other results are not expected.
+        }
     }
     {
         MessageParcel datas;
@@ -697,7 +700,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
         printf("service handler is nullptr");
         return 0;
     }
-
+    OHOS::OnRemoteRequestFuzzTest(incrementalRestoreService, data, size);
     OHOS::BackupOnFileReadyFuzzTest(backupService, data, size);
     OHOS::BackupOnBundleStartedFuzzTest(backupService, data, size);
     OHOS::BackupOnResultReportFuzzTest(backupService, data, size);
@@ -730,7 +733,5 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
     OHOS::IncrementalRestoreOnFileReadyFuzzTest(incrementalRestoreService, data, size);
     OHOS::IncrementalRestoreOnResultReportFuzzTest(incrementalRestoreService, data, size);
     OHOS::IncrementalRestoreOnProcessInfoFuzzTest(incrementalRestoreService, data, size);
-    OHOS::OnRemoteRequestFuzzTest(incrementalRestoreService, data, size);
-
     return 0;
 }
\ No newline at end of file