使用什么逻辑来生成应用程序挂起事件1002

Question

我想了解Microsoft使用什么逻辑来识别应用程序是否已挂起然后生成eventid = 1002，Source = Application hang。

此事件仅针对基于UI的应用程序生成，还是也适用于Windows服务？

http://www.microsoft.com/technet/support/ee/transform.aspx?ProdName=Windows+Operating+System&ProdVer=5.2&EvtID=1002&EvtSrc=Application+Hang&LCID=1033

Event Information:
Product:    Windows Operating System
Event ID:   1002
Source: Application Hang
Version:    5.2
Symbolic Name:  ER_HANG_LOG
Message:    Hanging application %1, version %2, hang module %3, version %4, hang address 0x%5.

Explanation
The indicated program stopped responding. The message contains details on which program
and module stopped responding. A matching event with EventID 1001 might also appear in the
event log. This matching event displays information about the specific error that
occurred.