Can we hook some func in another process then change return address?

For injecting you can use ForceLibrary, createprocess with the suspend flag, inject, resume process.

Hooking a function is just a matter of calling WriteProcessMemory and correctly modifying a call/jmp to the address of your code, and returning properly. Make SURE you take care of the stack correctly.

no,micro$oft's detours is the best,using it's api
DetourCreateProcessWithDll or DetourContinueProcessWithDll
u can inject a dll into another process very easily.
it also provide some apis with which one can hook functions in a simple way.