windows - 使用什么逻辑生成应用程序挂起事件1002

Question

我想了解微软使用什么逻辑来识别应用程序是否已挂起，然后生成 eventid=1002，Source = Application hang。

此事件仅针对基于 UI 的应用程序生成还是也适用于 Windows 服务？

http://www.microsoft.com/technet/support/ee/transform.aspx?ProdName=Windows+Operating+System&ProdVer=5.2&EvtID=1002&EvtSrc=Application+Hang&LCID=1033

Event Information:
Product:    Windows Operating System
Event ID:   1002
Source: Application Hang
Version:    5.2
Symbolic Name:  ER_HANG_LOG
Message:    Hanging application %1, version %2, hang module %3, version %4, hang address 0x%5.

Explanation
The indicated program stopped responding. The message contains details on which program
and module stopped responding. A matching event with EventID 1001 might also appear in the
event log. This matching event displays information about the specific error that
occurred.